Splunk Search

Field Extraction - same field from different log events

jbuhrmann
Engager

I have a firewall log search returning two different types of events but I'm trying to capture the source ip address from both. The events look like:
Deny inbound icmp src inside:172.22.15.90 ...
Inbound TCP connection denied from 172.22.15.90/53340 ...

The Field Extraction tool comes up with one or the other:
(?i) src inside:(?P[^/ ]+)
(?i) denied from (?P[^/ ]+)

Is there a way to combine the two regex statements into a single which will return a field called src_ip_inside for either event?

Tags (3)
0 Karma
1 Solution

Damien_Dallimor
Ultra Champion

Try something like :

... | rex field=_raw "(?i)(?:src inside:|denied from )(?<src_ip_inside>[^/ ]+)" | table src_ip_inside

View solution in original post

Damien_Dallimor
Ultra Champion

Try something like :

... | rex field=_raw "(?i)(?:src inside:|denied from )(?<src_ip_inside>[^/ ]+)" | table src_ip_inside

jbuhrmann
Engager

The field extraction worked great. Instead of | table at the end I used: | stats count(src_ip_inside) by src_ip_inside to get a table with each src ip and number of events for that ip. Thanks for the help!

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...