https://community.splunk.com/t5/Splunk-Search/How-to-create-search-to-filter-on-a-field-after-rex-extraction/m-p/602943#M209852 <P>Hello,</P> <P>I need to create a search that will display results based on a specific value.<BR /><BR />My issue is that the following search does not return any result. In penultimate line, when I replace user_ip by index_field1="1.2.3.4" it works and when I remove both last lines I can see user_ip well contains "1.2.3.4"... But index_field1=user_ip does not match, same for index_field2...<BR /><BR />index=...<BR />| eval field1="1.2.3.4:100"<BR />| rex field=src_ip_port "(?&lt;user_ip&gt;.+)\:(?&lt;user_port&gt;.+)"<BR />| table user_ip user_port<BR />| search index_field1=user_ip index_field2=user_port<BR />| table index_field1 index_field2 user_ip user_port<BR /><BR />Thanks by advance for your feedback.</P> Thu, 23 Jun 2022 19:19:58 GMT yanisA 2022-06-23T19:19:58Z https://community.splunk.com/t5/Splunk-Search/How-to-create-search-to-filter-on-a-field-after-rex-extraction/m-p/602943#M209852 <P>Hello,</P> <P>I need to create a search that will display results based on a specific value.<BR /><BR />My issue is that the following search does not return any result. In penultimate line, when I replace user_ip by index_field1="1.2.3.4" it works and when I remove both last lines I can see user_ip well contains "1.2.3.4"... But index_field1=user_ip does not match, same for index_field2...<BR /><BR />index=...<BR />| eval field1="1.2.3.4:100"<BR />| rex field=src_ip_port "(?&lt;user_ip&gt;.+)\:(?&lt;user_port&gt;.+)"<BR />| table user_ip user_port<BR />| search index_field1=user_ip index_field2=user_port<BR />| table index_field1 index_field2 user_ip user_port<BR /><BR />Thanks by advance for your feedback.</P> Thu, 23 Jun 2022 19:19:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-search-to-filter-on-a-field-after-rex-extraction/m-p/602943#M209852 yanisA 2022-06-23T19:19:58Z https://community.splunk.com/t5/Splunk-Search/How-to-create-search-to-filter-on-a-field-after-rex-extraction/m-p/603011#M209865 <P>The search command cannot accept a field name on both sides of the =.&nbsp; Use where, instead.</P><LI-CODE lang="markup">index=... | eval field1="1.2.3.4:100" | rex field=src_ip_port "(?&lt;user_ip&gt;.+)\:(?&lt;user_port&gt;.+)" | table user_ip user_port | where (index_field1=user_ip AND index_field2=user_port) | table index_field1 index_field2 user_ip user_port</LI-CODE> Thu, 23 Jun 2022 13:07:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-search-to-filter-on-a-field-after-rex-extraction/m-p/603011#M209865 richgalloway 2022-06-23T13:07:57Z