Splunk Search

Extracted field as variable

quatral
Explorer

Hi everyone,

A simple question about the field extractions. Suppose I've got 12 logs with basically some recurrent information, such as IP Addresses, MAC Addresses and Bytes (in or out, whatever).

My question is simple. I know an IPv4 address can be extracted with :

< ?ip_address(\d{1,3}\.){3}\d{1,3} >

Now, I have a extracted field name ip_address that I can set to a sourcetype, a source or a host and use the token * to specify all of them.

But the problem is, what if one of my log as two IP Addresses (let's say the Talker and the Listener). I've already the field ip_address available and it will catch the first IP address, but I'll be force to create an other one that will looks like that :

\d{1,3}\.){3}\d{1,3}.* < ?ip_listener(\d{1,3}\.){3}\d{1,3} >

(Just to know this is an exemple and it may actually not work)

So, my question is, is it possible to use something like :

%ip_address.* < ?ip_listener%ip_address >

instead, where %ip_address is a reference to the extracted field ip_address ?

Sorry for the long post.

Tags (1)
1 Solution

Ayn
Legend

Ayn
Legend

No, it is not.

quatral
Explorer

Exactly. I want to extract two IP Address in the same event. And sorry for the <, in the viewer the symbol didn't work and the code worked :S

My question is more about create "named regex" and use these named regex in other regex.

0 Karma

Rob
Splunk Employee
Splunk Employee

Are you looking for the value of the ip_address field or are you looking to reference the regex of the ip_address field?

I am assuming that you want to capture 2 different fields that are in the same event that look like IP addresses and one follows the other?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...