topic Extract field from another field in Splunk Search

Extract field from another field

lohit — Mon, 25 May 2015 06:16:34 GMT

Hi All,

I am having a field which has content like below

abc xyz sksk lsmlmlspmwmlmwpn wonmwm:29299 (abcxmmowmo.wsibi.w) X-Forwarded-For: xxx.xx.xxx.xxx xyz

Please note that there is a space between X-Forwarded-For:<space>xxx.xx.xxx.xxx

I want to extract the value of X-Forwarded-For: and then match it with a list of IPs from a lookup list and finally disregard those logs where this is a match.

PLease help !!

Re: Extract field from another field

MuS — Mon, 25 May 2015 06:36:53 GMT

Hi lohit,

you can use something like this:

your base search the get the field | rex field=TheFieldName "X-Forwarded-For:\s(?<myNew>.*)\s" | ....

This will create a new field called myNew.
Also take a look at this page https://regex101.com to learn and try regex and as well at the docs about the field extractor http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/ExtractfieldsinteractivelywithIFX and learn how to use it. It helps you to get anything out of your events into fields, which then can be used in any further search within the same app.

Hope this helps ...

cheers, MuS

Re: Extract field from another field

lohit — Mon, 25 May 2015 06:59:50 GMT

Thanks MuS. I figured it out earlier but with a more complex regex.

Re: Extract field from another field

woodcock — Sat, 06 Jun 2015 16:36:59 GMT

When you figure out your own answer, the proper thing to to is to answer your own question here and "Accept" your answer so that other people won't waste time trying to help you when you don't need it and so that others can be helped by your answer.

Re: Extract field from another field

lohit — Sat, 06 Jun 2015 16:43:54 GMT

Woodcock, if you can see i have already accepted MuS solution to be an answer. My reply was similar to MuS on that. Anywayz thanks for the suggestion.