Filtering a Field Extracted with Rex

[user333]

Hello,

I am having trouble with filtering fields extracted using rex as follows:

rex max_match=0 field=sessions_as_client "(?<SRC>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s--\>\s(?<DST>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}):(?<Port>\d+\/[a-zA-Z]+)"| where Port="123/UDP" | lookup dnslookup clientip as DST OUTPUT clienthost as DSTDNS | table Port DST DSTDNS

The field I am extracting looks as follows:

sessions_as_client="1.2.3.4 --> 1.2.3.5:21/TCP (ftp), 1.2.3.4 --> 1.2.3.5:23/TCP (telnet), 1.2.3.4 --> 1.2.3.5:123/UDP (ntp/udp)"

I am getting a table with the 123/UDP events as expected, but I am also getting the other events such as 21/TCP and 23/TCP in the same row as if each match from the rex statement was no longer applying to the search. Any recommendations are appreciated. 

[to4kawa · Accepted solution]

| rex max_match=0 field=sessions_as_client "(?<SRC>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s--\>\s(?<DST>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}):(?<Port>\d+\/[a-zA-Z]+)"
| eval tmp=mvzip(SRC,mvzip(DST,Port))
| mvexpand tmp
| eval src=mvindex(split(tmp,","),0) , DST=mvindex(split(tmp,","),1), Port=mvindex(split(tmp,","),2)
| where Port="123/UDP"
| lookup dnslookup clientip as DST OUTPUT clienthost as DSTDNS
| table Port DST DSTDNS

[user333]

This works. Thank you! Wasn't having this problem with stats or dc after the rex, so didn't know mvindex was needed.