Hello,
I need to create a search that will display results based on a specific value.
My issue is that the following search does not return any result. In penultimate line, when I replace user_ip by index_field1="1.2.3.4" it works and when I remove both last lines I can see user_ip well contains "1.2.3.4"... But index_field1=user_ip does not match, same for index_field2...
index=...
| eval field1="1.2.3.4:100"
| rex field=src_ip_port "(?<user_ip>.+)\:(?<user_port>.+)"
| table user_ip user_port
| search index_field1=user_ip index_field2=user_port
| table index_field1 index_field2 user_ip user_port
Thanks by advance for your feedback.
The search command cannot accept a field name on both sides of the =. Use where, instead.
index=...
| eval field1="1.2.3.4:100"
| rex field=src_ip_port "(?<user_ip>.+)\:(?<user_port>.+)"
| table user_ip user_port
| where (index_field1=user_ip AND index_field2=user_port)
| table index_field1 index_field2 user_ip user_port