Get the field name for a given value out of an event?

[fbl_itcs]

Hi,

let's say we have an event with the following information:

"Network Information:
Client Address: ee:fa:23:12:21:b1"

Is there a way to check if the Value after "Client Address" is already extracted into a field? It would be sort of a reverse search like "Tell me which fields has the value ee:fa:23:12:21:b1".

Thanks for your help,
Felix

[martin_mueller · Accepted solution]

I don't think the basic SPL can do that - however, you can write your own Python command that iterates over all fields looking for some value.

[fbl_itcs]

Works like a flaw! Thanks a lot!

[fbl_itcs]

Ill try it out. Would be great if it works.

The performance isn't of any issue, it would be more then enough if we use it on only one event (... | head 1 | ...).

[martin_mueller]

Giving this a bit more thought, there is a way to achieve this using basic SPL:

index=_internal | stats values(*) | transpose | rename "row 1" as values | search values=*23*

However, this is very inefficient and does not work for any reasonably large set of data. On my laptop with no real amount of data, this breaks for the _internal index even when using only the last 15 minutes.

[fbl_itcs]

Thanks for your answer.

I couldn't find a way by my own, but maybe someone will come up with something. It can be really hard to check if a given value is already extracted if there are like 80+ fields extracted.

If there is no solution it could be worth trying to write something by my own.