Splunk Search

Extracted field as variable

quatral
Explorer

Hi everyone,

A simple question about the field extractions. Suppose I've got 12 logs with basically some recurrent information, such as IP Addresses, MAC Addresses and Bytes (in or out, whatever).

My question is simple. I know an IPv4 address can be extracted with :

< ?ip_address(\d{1,3}\.){3}\d{1,3} >

Now, I have a extracted field name ip_address that I can set to a sourcetype, a source or a host and use the token * to specify all of them.

But the problem is, what if one of my log as two IP Addresses (let's say the Talker and the Listener). I've already the field ip_address available and it will catch the first IP address, but I'll be force to create an other one that will looks like that :

\d{1,3}\.){3}\d{1,3}.* < ?ip_listener(\d{1,3}\.){3}\d{1,3} >

(Just to know this is an exemple and it may actually not work)

So, my question is, is it possible to use something like :

%ip_address.* < ?ip_listener%ip_address >

instead, where %ip_address is a reference to the extracted field ip_address ?

Sorry for the long post.

Tags (1)
1 Solution

Ayn
Legend

Ayn
Legend

No, it is not.

quatral
Explorer

Exactly. I want to extract two IP Address in the same event. And sorry for the <, in the viewer the symbol didn't work and the code worked :S

My question is more about create "named regex" and use these named regex in other regex.

0 Karma

Rob
Splunk Employee
Splunk Employee

Are you looking for the value of the ip_address field or are you looking to reference the regex of the ip_address field?

I am assuming that you want to capture 2 different fields that are in the same event that look like IP addresses and one follows the other?

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...