Splunk Search

Using Concatenated Fields for With Wildcards for Searching

pagnihot
Path Finder

Hey Community

Need guidance with below scenario.
A user will provide an IP address as input. I want that last two octets of the input IP should be compared with the last two octets of the Source IP field and the matched results should be returned.

For example 

input_ip="1.2.3.4"

src_ip="4.5.3.4"

This should returns the results as the last two octets are matching.

I have tried replace first two octets with * using regex and strcat however, it doesn't works for me.

Labels (3)
0 Karma
1 Solution

pagnihot
Path Finder

Thank you  @gcusello  @VatsalJagani

This works for me. 

View solution in original post

0 Karma

pagnihot
Path Finder

Thank you  @gcusello  @VatsalJagani

This works for me. 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @pagnihot,

it's not so clear what's the solution ok for you, I say this for the people that will read your question!

Anyway, good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Hi @pagnihot,

I'm a Splunk Community Moderator here. Generally, you accept the answer as a solution which answer really helped you resolve the issue. So community users in the future can get the right guidance easily.

You can do that by clicking on the "Accept as Solution" button under the correct answer.

Thanks!!!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @pagnihot,

you could try to extract the last two octets from both the fields using regexes and check the results, something like this:

| rex field=input_ip "^\d+\.\d+\.(?<input_ip_check>\d+\.\d+)"
| rex field=src_ip "^\d+\.\d+\.(?<src_ip_check>\d+\.\d+)"
| search input_ip_check=input_ip_check

this is an approach that you can adapt to your real situation (e.g. input_ip is a token from an input?).

Ciao.

Giuseppe

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@pagnihot - If you are taking user input in the dashboard you can add to search here provided by @gcusello like this:

| eval input_ip=$user_input_tkn|s$

| rex field=input_ip "^\d+\.\d+\.(?<input_ip_check>\d+\.\d+)"
| rex field=src_ip "^\d+\.\d+\.(?<src_ip_check>\d+\.\d+)"
| search input_ip_check=input_ip_check

Where user_input_tkn is the token for your user input in the dashboard.

 

I hope this helps!!!

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...