Splunk Search

Using Concatenated Fields for With Wildcards for Searching

pagnihot
Explorer

Hey Community

Need guidance with below scenario.
A user will provide an IP address as input. I want that last two octets of the input IP should be compared with the last two octets of the Source IP field and the matched results should be returned.

For example 

input_ip="1.2.3.4"

src_ip="4.5.3.4"

This should returns the results as the last two octets are matching.

I have tried replace first two octets with * using regex and strcat however, it doesn't works for me.

Labels (3)
0 Karma
1 Solution

pagnihot
Explorer

Thank you  @gcusello  @VatsalJagani

This works for me. 

View solution in original post

0 Karma

pagnihot
Explorer

Thank you  @gcusello  @VatsalJagani

This works for me. 

0 Karma

gcusello
Esteemed Legend

Hi @pagnihot,

it's not so clear what's the solution ok for you, I say this for the people that will read your question!

Anyway, good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma

VatsalJagani
Champion

Hi @pagnihot,

I'm a Splunk Community Moderator here. Generally, you accept the answer as a solution which answer really helped you resolve the issue. So community users in the future can get the right guidance easily.

You can do that by clicking on the "Accept as Solution" button under the correct answer.

Thanks!!!

0 Karma

gcusello
Esteemed Legend

Hi @pagnihot,

you could try to extract the last two octets from both the fields using regexes and check the results, something like this:

| rex field=input_ip "^\d+\.\d+\.(?<input_ip_check>\d+\.\d+)"
| rex field=src_ip "^\d+\.\d+\.(?<src_ip_check>\d+\.\d+)"
| search input_ip_check=input_ip_check

this is an approach that you can adapt to your real situation (e.g. input_ip is a token from an input?).

Ciao.

Giuseppe

0 Karma

VatsalJagani
Champion

@pagnihot - If you are taking user input in the dashboard you can add to search here provided by @gcusello like this:

| eval input_ip=$user_input_tkn|s$

| rex field=input_ip "^\d+\.\d+\.(?<input_ip_check>\d+\.\d+)"
| rex field=src_ip "^\d+\.\d+\.(?<src_ip_check>\d+\.\d+)"
| search input_ip_check=input_ip_check

Where user_input_tkn is the token for your user input in the dashboard.

 

I hope this helps!!!

0 Karma
Get Updates on the Splunk Community!

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...