How do I create searchable fields from a single raw string?

[kluey]

Hi,

I have syslogs that I would like to search for by ZONE (UNTRUST) and IP (12.12.12.1). Below is a sample of how the data is formatted as one long field. I would like to be able to do a search on ‘UNTRUST’ and then sort/count by IP (10.10.10.10) and Port (80).

Syslog sample: UNTRUST/12.12.12.1(80)

Any help would be greatly appreciated.

TIA

[kluey]

Thanks for the feedback. I have clicked the check mark to accept the answer.

[kluey · Accepted solution]

Hi, thanks for the response. It worked perfectly!

[lguinn2]

You are welcome!

BTW, if you accept the answer by clicking the check mark, then your question shows up as answered and other folks won't keep checking in to see if you need help.

Thanks!

[lguinn2]

You probably want to create and save field extractions. There are several ways to do this: Overview of search-time field extractions is a good place to start.

However, if you don't want to do this, you can create and use temporary fields with the rex command like this:

sourcetype=syslog untrust*
| rex "UNTRUST/(?<IP>.*?)\((?<Port>\d+)\)"
| stats count by IP Port