Splunk Search

to search and show a string in the same field.

fasantos
New Member

Dears,

I would like to search and show a string in the field that contains multiples values. Ex.: In the IP field, there are multiples IPs as below :

IP field
10.XXX.XXX.XXX 200.XXX.XXX.XXX

I would like to search only IPs that start with "200.". Until now i've used the syntaxe "| where like(IP,"%200.%") ". But, i need to show only the IP that start with "200." to do outer join with another search.

Can you help me?

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Assuming that these IP's are separated by space, you can convert them to multi valued field and then filter them for specific IP. Something like this

Your base search | makemv IP_field delim=" " | eval IP_field=mvfilter(match(IP_field,"^200\")) | ...you got your IP_field filtered with just the IP's starting with 200.

View solution in original post

0 Karma

somesoni2
Revered Legend

Assuming that these IP's are separated by space, you can convert them to multi valued field and then filter them for specific IP. Something like this

Your base search | makemv IP_field delim=" " | eval IP_field=mvfilter(match(IP_field,"^200\")) | ...you got your IP_field filtered with just the IP's starting with 200.
0 Karma

fasantos
New Member

Perfect. I reproduced this orientation and it's correct.

Thanks so much.

Regards,
Fábio Augusto

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...