Hello,
I am having trouble with filtering fields extracted using rex as follows:
rex max_match=0 field=sessions_as_client "(?<SRC>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s--\>\s(?<DST>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}):(?<Port>\d+\/[a-zA-Z]+)"| where Port="123/UDP" | lookup dnslookup clientip as DST OUTPUT clienthost as DSTDNS | table Port DST DSTDNS
The field I am extracting looks as follows:
sessions_as_client="1.2.3.4 --> 1.2.3.5:21/TCP (ftp), 1.2.3.4 --> 1.2.3.5:23/TCP (telnet), 1.2.3.4 --> 1.2.3.5:123/UDP (ntp/udp)"
I am getting a table with the 123/UDP events as expected, but I am also getting the other events such as 21/TCP and 23/TCP in the same row as if each match from the rex statement was no longer applying to the search. Any recommendations are appreciated.
| rex max_match=0 field=sessions_as_client "(?<SRC>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s--\>\s(?<DST>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}):(?<Port>\d+\/[a-zA-Z]+)"
| eval tmp=mvzip(SRC,mvzip(DST,Port))
| mvexpand tmp
| eval src=mvindex(split(tmp,","),0) , DST=mvindex(split(tmp,","),1), Port=mvindex(split(tmp,","),2)
| where Port="123/UDP"
| lookup dnslookup clientip as DST OUTPUT clienthost as DSTDNS
| table Port DST DSTDNS
| rex max_match=0 field=sessions_as_client "(?<SRC>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s--\>\s(?<DST>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}):(?<Port>\d+\/[a-zA-Z]+)"
| eval tmp=mvzip(SRC,mvzip(DST,Port))
| mvexpand tmp
| eval src=mvindex(split(tmp,","),0) , DST=mvindex(split(tmp,","),1), Port=mvindex(split(tmp,","),2)
| where Port="123/UDP"
| lookup dnslookup clientip as DST OUTPUT clienthost as DSTDNS
| table Port DST DSTDNS