topic Re: How do I reference other fields in a Splunk regex search? in Splunk Search

How do I reference other fields in a Splunk regex search?

jonbelanger — Tue, 01 Nov 2016 22:01:23 GMT

Would like to do this:

Where indexa has two fields, md5 and allmd5

Two records exist like this:

md5=99ed710da1d10b1cf8c4fb7c2549a9dc
allmd5={"MD5":"99ed710da1d10b1cf8c4fb7c2549a9dc". MD5:"6ac349a75ff9e7cbc92cd68c5fc44eed", "MD5":"8ca9e5e0a7cdb058f6f33f60a2fde2ef"}

md5=45c4a725006767124e21242670e7795f 
allmd5={"MD5":"99ed710da1d10b1cf8c4fb7c2549a9dc". MD5:"6ac349a75ff9e7cbc92cd68c5fc44eed", "MD5":"8ca9e5e0a7cdb058f6f33f60a2fde2ef"}

I've tried:

index=indexa | regex allmd5!=md5

and

index=indexa | regex allmd5!="\"".md5."\""

Tried it with eval too

but it always returns all records where it should just return the case where the value of md5 for that record is NOT in the allmd5 value.

What am I missing?

Re: How do I reference other fields in a Splunk regex search?

bshuler_splunk — Tue, 01 Nov 2016 22:55:20 GMT

| makeresults | eval data="md5=99ed710da1d10b1cf8c4fb7c2549a9dc#allmd5={\"MD5\":\"99ed710da1d10b1cf8c4fb7c2549a9dc\". MD5:\"6ac349a75ff9e7cbc92cd68c5fc44eed\", \"MD5\":\"8ca9e5e0a7cdb058f6f33f60a2fde2ef\"}%md5=45c4a725006767124e21242670e7795f#allmd5={\"MD5\":\"99ed710da1d10b1cf8c4fb7c2549a9dc\". MD5:\"6ac349a75ff9e7cbc92cd68c5fc44eed\", \"MD5\":\"8ca9e5e0a7cdb058f6f33f60a2fde2ef\"}\"" | rex max_match=0 field=data "(?<line>[^%]+)" | mvexpand line |  rex  field=line "md5=(?<md5>[^#]+)#allmd5=(?<allmd5>[^#]+)" | table md5 allmd5 | where NOT match(allmd5, md5)

Re: How do I reference other fields in a Splunk regex search?

gokadroid — Tue, 01 Nov 2016 23:56:46 GMT

Can you try this simply:

yourBaseSearch to return md5 and allmd5
| eval matched=if(match(allmd5, md5), 1, 0)
| table md5, allmd5, matched
| where matched=0

Re: How do I reference other fields in a Splunk regex search?

jonbelanger — Wed, 02 Nov 2016 03:16:17 GMT

worked perfectly, thank you!