Hello,
I need to create a search that will display results based on a specific value. My issue is that the following search does not return any result. In penultimate line, when I replace user_ip by index_field1="1.2.3.4" it works and when I remove both last lines I can see user_ip well contains "1.2.3.4"... But index_field1=user_ip does not match, same for index_field2... index=... | eval field1="1.2.3.4:100" | rex field=src_ip_port "(?<user_ip>.+)\:(?<user_port>.+)" | table user_ip user_port | search index_field1=user_ip index_field2=user_port | table index_field1 index_field2 user_ip user_port Thanks by advance for your feedback.
... View more