Field Extraction - same field from different log events

[jbuhrmann]

I have a firewall log search returning two different types of events but I'm trying to capture the source ip address from both. The events look like:
Deny inbound icmp src inside:172.22.15.90 ...
Inbound TCP connection denied from 172.22.15.90/53340 ...

The Field Extraction tool comes up with one or the other:
(?i) src inside:(?P[^/ ]+)
(?i) denied from (?P[^/ ]+)

Is there a way to combine the two regex statements into a single which will return a field called src_ip_inside for either event?

[Damien_Dallimor · Accepted solution]

Try something like :

... | rex field=_raw "(?i)(?:src inside:|denied from )(?<src_ip_inside>[^/ ]+)" | table src_ip_inside

[jbuhrmann]

The field extraction worked great. Instead of | table at the end I used: | stats count(src_ip_inside) by src_ip_inside to get a table with each src ip and number of events for that ip. Thanks for the help!