Splunk Search

Extract field from another field

lohit
Path Finder

Hi All,

I am having a field which has content like below

abc xyz sksk lsmlmlspmwmlmwpn wonmwm:29299 (abcxmmowmo.wsibi.w) X-Forwarded-For: xxx.xx.xxx.xxx xyz

Please note that there is a space between X-Forwarded-For:<space>xxx.xx.xxx.xxx

I want to extract the value of X-Forwarded-For: and then match it with a list of IPs from a lookup list and finally disregard those logs where this is a match.

PLease help !!

Tags (2)
0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi lohit,

you can use something like this:

your base search the get the field | rex field=TheFieldName "X-Forwarded-For:\s(?<myNew>.*)\s" | ....

This will create a new field called myNew.
Also take a look at this page https://regex101.com to learn and try regex and as well at the docs about the field extractor http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/ExtractfieldsinteractivelywithIFX and learn how to use it. It helps you to get anything out of your events into fields, which then can be used in any further search within the same app.

Hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi lohit,

you can use something like this:

your base search the get the field | rex field=TheFieldName "X-Forwarded-For:\s(?<myNew>.*)\s" | ....

This will create a new field called myNew.
Also take a look at this page https://regex101.com to learn and try regex and as well at the docs about the field extractor http://docs.splunk.com/Documentation/Splunk/6.2.3/Knowledge/ExtractfieldsinteractivelywithIFX and learn how to use it. It helps you to get anything out of your events into fields, which then can be used in any further search within the same app.

Hope this helps ...

cheers, MuS

lohit
Path Finder

Thanks MuS. I figured it out earlier but with a more complex regex.

0 Karma

woodcock
Esteemed Legend

When you figure out your own answer, the proper thing to to is to answer your own question here and "Accept" your answer so that other people won't waste time trying to help you when you don't need it and so that others can be helped by your answer.

0 Karma

lohit
Path Finder

Woodcock, if you can see i have already accepted MuS solution to be an answer. My reply was similar to MuS on that. Anywayz thanks for the suggestion.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...