In my Search 1, it will list all unique port numbers associated with a certain IP address, i.e. 1.2.3.4
"MYTOKEN is: fcd4e600-eda2-4ee0-a3b3-093562f49c2e" | rex "1.2.3.4:(?<ipport>.*?) " | dedup ipport | table ipport | table ipport
And then I'd like to concatenate those ports into one long string delimitated with "," that is, "57432, 57453,57198" and finally this concatenated string will be used in another search, i.e
"https_client-init <HTTP_REQUEST>: " | rex "2.3.4.5:(?<port>.*?) " | search port IN([search "MYTOKEN is: fcd4e600-eda2-4ee0-a3b3-093562f49c2e" | rex "1.2.3.4:(?<ipport>.*?) " | dedup ipport | table ipport | table ipport])
It will be really appreciated if someone could shed the light of how it can be solved. thanks in advance!
Hi @vsasdao,
Please try below query;
"https_client-init <HTTP_REQUEST>: " | rex "2.3.4.5:(?<port>.*?) " | search [search "MYTOKEN is: fcd4e600-eda2-4ee0-a3b3-093562f49c2e" | rex "1.2.3.4:(?<port>.*?) " | dedup port | fields port]
If this reply helps you an upvote is appreciated.
it works well. Can you explain a bit how you've fixed it?
Great!
Subsearches formats the results into a single linear search string. You can this string by running the subsearch by adding "| format" command at the end. I changed field name to port to create suitable search string from subsearch.
You can find more detail in below doc.
https://docs.splunk.com/Documentation/SplunkCloud/8.1.2011/Search/Changetheformatofsubsearchresults
Hi @vsasdao,
Please try below query;
"https_client-init <HTTP_REQUEST>: " | rex "2.3.4.5:(?<port>.*?) " | search [search "MYTOKEN is: fcd4e600-eda2-4ee0-a3b3-093562f49c2e" | rex "1.2.3.4:(?<port>.*?) " | dedup port | fields port]
If this reply helps you an upvote is appreciated.