Splunk Search

How to create search to filter on a field after rex extraction?

yanisA
Explorer

Hello,

I need to create a search that will display results based on a specific value.

My issue is that the following search does not return any result. In penultimate line, when I replace user_ip by index_field1="1.2.3.4" it works and when I remove both last lines I can see user_ip well contains "1.2.3.4"... But index_field1=user_ip does not match, same for index_field2...

index=...
| eval field1="1.2.3.4:100"
| rex field=src_ip_port "(?<user_ip>.+)\:(?<user_port>.+)"
| table user_ip user_port
| search index_field1=user_ip index_field2=user_port
| table index_field1 index_field2 user_ip user_port

Thanks by advance for your feedback.

Labels (2)
Tags (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The search command cannot accept a field name on both sides of the =.  Use where, instead.

index=...
| eval field1="1.2.3.4:100"
| rex field=src_ip_port "(?<user_ip>.+)\:(?<user_port>.+)"
| table user_ip user_port
| where (index_field1=user_ip AND index_field2=user_port)
| table index_field1 index_field2 user_ip user_port
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 3)

Welcome back to Splunk Classroom Chronicles, our ongoing blog series that pulls back the curtain on Splunk ...

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Almost Too Eventful Assurance: Part 1

Modern IT and Network teams still struggle with too many alerts and isolating issues before they are notified. ...