How to create search to filter on a field after rex extraction?

[yanisA]

Hello,

I need to create a search that will display results based on a specific value.

My issue is that the following search does not return any result. In penultimate line, when I replace user_ip by index_field1="1.2.3.4" it works and when I remove both last lines I can see user_ip well contains "1.2.3.4"... But index_field1=user_ip does not match, same for index_field2...

index=...
| eval field1="1.2.3.4:100"
| rex field=src_ip_port "(?<user_ip>.+)\:(?<user_port>.+)"
| table user_ip user_port
| search index_field1=user_ip index_field2=user_port
| table index_field1 index_field2 user_ip user_port

Thanks by advance for your feedback.

[richgalloway]

The search command cannot accept a field name on both sides of the =.  Use where, instead.

index=...
| eval field1="1.2.3.4:100"
| rex field=src_ip_port "(?<user_ip>.+)\:(?<user_port>.+)"
| table user_ip user_port
| where (index_field1=user_ip AND index_field2=user_port)
| table index_field1 index_field2 user_ip user_port