Using Concatenated Fields for With Wildcards for Searching

[pagnihot]

Hey Community

Need guidance with below scenario.
A user will provide an IP address as input. I want that last two octets of the input IP should be compared with the last two octets of the Source IP field and the matched results should be returned.

For example 

input_ip="1.2.3.4"

src_ip="4.5.3.4"

This should returns the results as the last two octets are matching.

I have tried replace first two octets with * using regex and strcat however, it doesn't works for me.

[pagnihot · Accepted solution]

Thank you  @gcusello  @VatsalJagani

This works for me. 

[gcusello]

Hi @pagnihot,

it's not so clear what's the solution ok for you, I say this for the people that will read your question!

Anyway, good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[VatsalJagani]

Hi @pagnihot,

I'm a Splunk Community Moderator here. Generally, you accept the answer as a solution which answer really helped you resolve the issue. So community users in the future can get the right guidance easily.

You can do that by clicking on the "Accept as Solution" button under the correct answer.

Thanks!!!

[gcusello]

Hi @pagnihot,

you could try to extract the last two octets from both the fields using regexes and check the results, something like this:

| rex field=input_ip "^\d+\.\d+\.(?<input_ip_check>\d+\.\d+)"
| rex field=src_ip "^\d+\.\d+\.(?<src_ip_check>\d+\.\d+)"
| search input_ip_check=input_ip_check

this is an approach that you can adapt to your real situation (e.g. input_ip is a token from an input?).

Ciao.

Giuseppe

[VatsalJagani]

@pagnihot - If you are taking user input in the dashboard you can add to search here provided by @gcusello like this:

| eval input_ip=$user_input_tkn|s$

| rex field=input_ip "^\d+\.\d+\.(?<input_ip_check>\d+\.\d+)"
| rex field=src_ip "^\d+\.\d+\.(?<src_ip_check>\d+\.\d+)"
| search input_ip_check=input_ip_check

Where user_input_tkn is the token for your user input in the dashboard.

I hope this helps!!!