Need help defining fields

[johnnybravo]

I want to use dedup to reduce occurrences of the same event like the following:

%IP-4-DUPADDR: Duplicate address 1.1.1.1 on Vlan100, sourced by 0000.5ee5.deed

However if the IP address, VLAN, or MAC address is different then I don't want to dedup it. I tried defining the whole block of text as a field, but that doesn't appear to work. It seems like a field cannot include spaces.

How do I go about defining this so that if the message is of type IP-4-DUPADDR and the address info is the same, dedup it?

[dwaddle · Accepted solution]

I might approach it similar to this:

IP-4-DUPADDR 
| rex "Duplicate address (?<ipaddr>[^\s]+) on (?<vlan>[^\s]+) sourced by (?<macaddr>[^\s]+)
| dedup 1 vlan,ipaddr,macaddr

[johnnybravo]

Thank you, that works!

[Ayn]

Fields can absolutely contain spaces! There is no such limitation.

When you say the fields are "the same" or "different", what is that in comparison to, the previous event? Anyway, you can either extract the whole string like you say, or you can dedup based on all fields.

[johnnybravo]

Good to know they can contain spaces. I think my problem is getting the comma to delimit correctly. If I enclose the entire example message above with # in the field picker, it finds no results. If I don't add the #, it wants to add two fields, before and after the comma.

Yes, they would be the same or different in comparison to previous events for that host.

Thanks for the reply!