- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How can I extract two fields as a single field in ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How can I extract two fields as a single field in my search result. The log format is as follows :
Apr 24 18:37:07 10.11.26.83 2012-04-24 06:07:09.732 -0700 barracuda WF ALER SQL_INJECTION_IN_URL 99.99.182.1 44727 99.99.83.74 80 security-policy GLOBAL DENY NONE [type="sql-injection-medium" pattern="sql-comments" token="/"] GET 99.99.83.74/index.html// HTTP "-" "Wget/1.12 (linux-gnu)" 99.99.182.1 44727 "-" "-"
The two fields in bold letters are the application_ip and application_port fields respectively. And I want to extract the two fields together in my search results in the format of application_ip:application:port . How can this be done ?
Please help ...
Thanks...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Here is an extraction that should work with the above sample event text.I don't know what all your events look like so I can only provide an example regex based on what you provided, therefore you may need to adjust the regex as necessary to work with a wider selection of event text formats.
... | rex field=_raw "^(?i).+barracuda\s\w+\s\w+\s\w+\s\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\s\d{2,5}\s(?<ipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s(?<port>\d{2,5})\s.+$" | eval ip_port=ipaddress+":"+port | table ip_port
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Here is an extraction that should work with the above sample event text.I don't know what all your events look like so I can only provide an example regex based on what you provided, therefore you may need to adjust the regex as necessary to work with a wider selection of event text formats.
... | rex field=_raw "^(?i).+barracuda\s\w+\s\w+\s\w+\s\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\s\d{2,5}\s(?<ipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s(?<port>\d{2,5})\s.+$" | eval ip_port=ipaddress+":"+port | table ip_port
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks a lot Damien ... This works ...
Announcing Scheduled Export GA for Dashboard Studio
Extending Observability Content to Splunk Cloud
More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!
