topic Re: Using Concatenated Fields for With Wildcards for Searching in Splunk Search

Using Concatenated Fields for With Wildcards for Searching

pagnihot — Thu, 30 Jun 2022 09:00:38 GMT

Hey Community

Need guidance with below scenario.
A user will provide an IP address as input. I want that last two octets of the input IP should be compared with the last two octets of the Source IP field and the matched results should be returned.

For example

input_ip="1.2.3.4"

src_ip="4.5.3.4"

This should returns the results as the last two octets are matching.

I have tried replace first two octets with * using regex and strcat however, it doesn't works for me.

Re: Using Concatenated Fields for With Wildcards for Searching

gcusello — Thu, 30 Jun 2022 09:06:45 GMT

Hi @pagnihot,

you could try to extract the last two octets from both the fields using regexes and check the results, something like this:

| rex field=input_ip "^\d+\.\d+\.(?<input_ip_check>\d+\.\d+)" | rex field=src_ip "^\d+\.\d+\.(?<src_ip_check>\d+\.\d+)" | search input_ip_check=input_ip_check

this is an approach that you can adapt to your real situation (e.g. input_ip is a token from an input?).

Ciao.

Giuseppe

Re: Using Concatenated Fields for With Wildcards for Searching

VatsalJagani — Thu, 30 Jun 2022 09:19:32 GMT

@pagnihot - If you are taking user input in the dashboard you can add to search here provided by @gcusello like this:

Where user_input_tkn is the token for your user input in the dashboard.

I hope this helps!!!

Re: Using Concatenated Fields for With Wildcards for Searching

pagnihot — Thu, 30 Jun 2022 10:00:01 GMT

Thank you @gcusello @VatsalJagani

This works for me.

Re: Using Concatenated Fields for With Wildcards for Searching

VatsalJagani — Thu, 30 Jun 2022 10:04:48 GMT

Hi @pagnihot,

I'm a Splunk Community Moderator here. Generally, you accept the answer as a solution which answer really helped you resolve the issue. So community users in the future can get the right guidance easily.

You can do that by clicking on the "Accept as Solution" button under the correct answer.

Thanks!!!

Re: Using Concatenated Fields for With Wildcards for Searching

gcusello — Thu, 30 Jun 2022 10:04:29 GMT

Hi @pagnihot,

it's not so clear what's the solution ok for you, I say this for the people that will read your question!

Anyway, good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉