Extract field from another field

[lohit]

Hi All,

I am having a field which has content like below

abc xyz sksk lsmlmlspmwmlmwpn wonmwm:29299 (abcxmmowmo.wsibi.w) X-Forwarded-For: xxx.xx.xxx.xxx xyz

Please note that there is a space between X-Forwarded-For:<space>xxx.xx.xxx.xxx

I want to extract the value of X-Forwarded-For: and then match it with a list of IPs from a lookup list and finally disregard those logs where this is a match.

PLease help !!

[MuS · Accepted solution]

Hi lohit,

you can use something like this:

your base search the get the field | rex field=TheFieldName "X-Forwarded-For:\s(?<myNew>.*)\s" | ....

This will create a new field called myNew.
Also take a look at this page https://regex101.com to learn and try regex and as well at the docs about the field extractor http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/ExtractfieldsinteractivelywithIFX and learn how to use it. It helps you to get anything out of your events into fields, which then can be used in any further search within the same app.

Hope this helps ...

cheers, MuS

[lohit]

Thanks MuS. I figured it out earlier but with a more complex regex.

[woodcock]

When you figure out your own answer, the proper thing to to is to answer your own question here and "Accept" your answer so that other people won't waste time trying to help you when you don't need it and so that others can be helped by your answer.

[lohit]

Woodcock, if you can see i have already accepted MuS solution to be an answer. My reply was similar to MuS on that. Anywayz thanks for the suggestion.