Splunk Search

Filtering a Field Extracted with Rex

Engager

Hello,

I am having trouble with filtering fields extracted using rex as follows:

rex max_match=0 field=sessions_as_client "(?<SRC>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s--\>\s(?<DST>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}):(?<Port>\d+\/[a-zA-Z]+)"| where Port="123/UDP" | lookup dnslookup clientip as DST OUTPUT clienthost as DSTDNS | table Port DST DSTDNS

 

The field I am extracting looks as follows:

sessions_as_client="1.2.3.4 --> 1.2.3.5:21/TCP (ftp), 1.2.3.4 --> 1.2.3.5:23/TCP (telnet), 1.2.3.4 --> 1.2.3.5:123/UDP (ntp/udp)"

 

I am getting a table with the 123/UDP events as expected, but I am also getting the other events such as 21/TCP and 23/TCP in the same row as if each match from the rex statement was no longer applying to the search. Any recommendations are appreciated. 

Labels (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

| rex max_match=0 field=sessions_as_client "(?<SRC>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s--\>\s(?<DST>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}):(?<Port>\d+\/[a-zA-Z]+)"
| eval tmp=mvzip(SRC,mvzip(DST,Port))
| mvexpand tmp
| eval src=mvindex(split(tmp,","),0) , DST=mvindex(split(tmp,","),1), Port=mvindex(split(tmp,","),2)
| where Port="123/UDP"
| lookup dnslookup clientip as DST OUTPUT clienthost as DSTDNS
| table Port DST DSTDNS

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

| rex max_match=0 field=sessions_as_client "(?<SRC>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s--\>\s(?<DST>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}):(?<Port>\d+\/[a-zA-Z]+)"
| eval tmp=mvzip(SRC,mvzip(DST,Port))
| mvexpand tmp
| eval src=mvindex(split(tmp,","),0) , DST=mvindex(split(tmp,","),1), Port=mvindex(split(tmp,","),2)
| where Port="123/UDP"
| lookup dnslookup clientip as DST OUTPUT clienthost as DSTDNS
| table Port DST DSTDNS

View solution in original post

0 Karma

Engager

This works. Thank you! Wasn't having this problem with stats or dc after the rex, so didn't know mvindex was needed.

Tags (3)
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!