how to store a value from rex and reuse this value in another search

[silverem78]

Dear fellows,

I have two logs and i am looking to do some correlation between them.

In the log1, i am looking for IP_x (ex: 2.2.2.2)associated with IP_1 (1.1.1.1), then reuse the value of IP_x (2.2.2.2) in another search.

When i execute, i got nothing.

index=* sourcetype=log1 [search index=* sourcetype=log2  src_ip="1.1.1.1" 
| rex field=_raw "src-ip (?<src-ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | eval src_ip =src-ip | table src_ip ] src_ip

if i do this, i got the details

index=* sourcetype=log1 2.2.2.2

when i execute manually the search , i got the table with 2.2.2.2

search index=* sourcetype=log2  src_ip="1.1.1.1" 
| rex field=_raw "src-ip (?<src-ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | eval src_ip =src-ip | table src_ip

Any helps will be welcomed

[aasabatini]

Hi @silverem78 

try this:

index=* sourcetype=log1 [search index=* sourcetype=log2  src_ip="1.1.1.1" 
| rex field=_raw "src-ip (?<src-ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | eval src_ip =src-ip | fields src_ip ] 

if doesn't works can you run this search and share the result?

search index=* sourcetype=log2  src_ip="1.1.1.1" 
| rex field=_raw "src-ip (?<src-ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | eval src_ip =src-ip | table src_ip | fieldformat

[silverem78]

I got an error with:

search index=* sourcetype=log2  src_ip="1.1.1.1" 
| rex field=_raw "src-ip (?<src-ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | eval src_ip =src-ip | table src_ip | fieldformat

I got nothing  (with no error) :

index=* sourcetype=log1 [search index=* sourcetype=log2  src_ip="1.1.1.1" 
| rex field=_raw "src-ip (?<src-ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | eval src_ip =src-ip | fields src_ip ] 

  it is like "[search index=* sourcetype=log2 src_ip="1.1.1.1"
| rex field=_raw "src-ip (?<src-ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | eval src_ip =src-ip | fields src_ip ] " doesnt provide value. 2.2.2.2 ...

[aasabatini]

Hi @silverem78 

sorry for the error try this search and please share the result

 index=* sourcetype=log2  src_ip="1.1.1.1" 
| rex field=_raw "src-ip (?<src-ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | eval src_ip =src-ip | table src_ip | format

[silverem78]

Hi

I got an error.

[aasabatini]

Hi @silverem78 

Can you share the error?