I have a firewall log search returning two different types of events but I'm trying to capture the source ip address from both. The events look like:
Deny inbound icmp src inside:172.22.15.90 ...
Inbound TCP connection denied from 172.22.15.90/53340 ...
The Field Extraction tool comes up with one or the other:
(?i) src inside:(?P
(?i) denied from (?P
Is there a way to combine the two regex statements into a single which will return a field called src_ip_inside for either event?
Try something like :
... | rex field=_raw "(?i)(?:src inside:|denied from )(?<src_ip_inside>[^/ ]+)" | table src_ip_inside
Try something like :
... | rex field=_raw "(?i)(?:src inside:|denied from )(?<src_ip_inside>[^/ ]+)" | table src_ip_inside
The field extraction worked great. Instead of | table at the end I used: | stats count(src_ip_inside) by src_ip_inside to get a table with each src ip and number of events for that ip. Thanks for the help!