Splunk Search

to search and show a string in the same field.

fasantos
New Member

Dears,

I would like to search and show a string in the field that contains multiples values. Ex.: In the IP field, there are multiples IPs as below :

IP field
10.XXX.XXX.XXX 200.XXX.XXX.XXX

I would like to search only IPs that start with "200.". Until now i've used the syntaxe "| where like(IP,"%200.%") ". But, i need to show only the IP that start with "200." to do outer join with another search.

Can you help me?

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Assuming that these IP's are separated by space, you can convert them to multi valued field and then filter them for specific IP. Something like this

Your base search | makemv IP_field delim=" " | eval IP_field=mvfilter(match(IP_field,"^200\")) | ...you got your IP_field filtered with just the IP's starting with 200.

View solution in original post

0 Karma

somesoni2
Revered Legend

Assuming that these IP's are separated by space, you can convert them to multi valued field and then filter them for specific IP. Something like this

Your base search | makemv IP_field delim=" " | eval IP_field=mvfilter(match(IP_field,"^200\")) | ...you got your IP_field filtered with just the IP's starting with 200.

View solution in original post

0 Karma

fasantos
New Member

Perfect. I reproduced this orientation and it's correct.

Thanks so much.

Regards,
Fábio Augusto

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!