Splunk Search

Filtering a Field Extracted with Rex

user333
Engager

Hello,

I am having trouble with filtering fields extracted using rex as follows:

rex max_match=0 field=sessions_as_client "(?<SRC>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s--\>\s(?<DST>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}):(?<Port>\d+\/[a-zA-Z]+)"| where Port="123/UDP" | lookup dnslookup clientip as DST OUTPUT clienthost as DSTDNS | table Port DST DSTDNS

 

The field I am extracting looks as follows:

sessions_as_client="1.2.3.4 --> 1.2.3.5:21/TCP (ftp), 1.2.3.4 --> 1.2.3.5:23/TCP (telnet), 1.2.3.4 --> 1.2.3.5:123/UDP (ntp/udp)"

 

I am getting a table with the 123/UDP events as expected, but I am also getting the other events such as 21/TCP and 23/TCP in the same row as if each match from the rex statement was no longer applying to the search. Any recommendations are appreciated. 

Labels (2)
0 Karma
1 Solution

to4kawa
Ultra Champion

| rex max_match=0 field=sessions_as_client "(?<SRC>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s--\>\s(?<DST>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}):(?<Port>\d+\/[a-zA-Z]+)"
| eval tmp=mvzip(SRC,mvzip(DST,Port))
| mvexpand tmp
| eval src=mvindex(split(tmp,","),0) , DST=mvindex(split(tmp,","),1), Port=mvindex(split(tmp,","),2)
| where Port="123/UDP"
| lookup dnslookup clientip as DST OUTPUT clienthost as DSTDNS
| table Port DST DSTDNS

View solution in original post

0 Karma

to4kawa
Ultra Champion

| rex max_match=0 field=sessions_as_client "(?<SRC>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s--\>\s(?<DST>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}):(?<Port>\d+\/[a-zA-Z]+)"
| eval tmp=mvzip(SRC,mvzip(DST,Port))
| mvexpand tmp
| eval src=mvindex(split(tmp,","),0) , DST=mvindex(split(tmp,","),1), Port=mvindex(split(tmp,","),2)
| where Port="123/UDP"
| lookup dnslookup clientip as DST OUTPUT clienthost as DSTDNS
| table Port DST DSTDNS

0 Karma

user333
Engager

This works. Thank you! Wasn't having this problem with stats or dc after the rex, so didn't know mvindex was needed.

Tags (3)
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...