Need guidance with below scenario.
A user will provide an IP address as input. I want that last two octets of the input IP should be compared with the last two octets of the Source IP field and the matched results should be returned.
This should returns the results as the last two octets are matching.
I have tried replace first two octets with * using regex and strcat however, it doesn't works for me.
it's not so clear what's the solution ok for you, I say this for the people that will read your question!
Anyway, good for you, see next time!
Ciao and happy splunking
P.S.: Karma Points are appreciated by all the contributors 😉
I'm a Splunk Community Moderator here. Generally, you accept the answer as a solution which answer really helped you resolve the issue. So community users in the future can get the right guidance easily.
You can do that by clicking on the "Accept as Solution" button under the correct answer.
you could try to extract the last two octets from both the fields using regexes and check the results, something like this:
| rex field=input_ip "^\d+\.\d+\.(?<input_ip_check>\d+\.\d+)" | rex field=src_ip "^\d+\.\d+\.(?<src_ip_check>\d+\.\d+)" | search input_ip_check=input_ip_check
this is an approach that you can adapt to your real situation (e.g. input_ip is a token from an input?).
| eval input_ip=$user_input_tkn|s$ | rex field=input_ip "^\d+\.\d+\.(?<input_ip_check>\d+\.\d+)" | rex field=src_ip "^\d+\.\d+\.(?<src_ip_check>\d+\.\d+)" | search input_ip_check=input_ip_check
Where user_input_tkn is the token for your user input in the dashboard.
I hope this helps!!!