Splunk Search

Extracted field as variable

quatral
Explorer

Hi everyone,

A simple question about the field extractions. Suppose I've got 12 logs with basically some recurrent information, such as IP Addresses, MAC Addresses and Bytes (in or out, whatever).

My question is simple. I know an IPv4 address can be extracted with :

< ?ip_address(\d{1,3}\.){3}\d{1,3} >

Now, I have a extracted field name ip_address that I can set to a sourcetype, a source or a host and use the token * to specify all of them.

But the problem is, what if one of my log as two IP Addresses (let's say the Talker and the Listener). I've already the field ip_address available and it will catch the first IP address, but I'll be force to create an other one that will looks like that :

\d{1,3}\.){3}\d{1,3}.* < ?ip_listener(\d{1,3}\.){3}\d{1,3} >

(Just to know this is an exemple and it may actually not work)

So, my question is, is it possible to use something like :

%ip_address.* < ?ip_listener%ip_address >

instead, where %ip_address is a reference to the extracted field ip_address ?

Sorry for the long post.

Tags (1)
1 Solution

Ayn
Legend

Ayn
Legend

No, it is not.

quatral
Explorer

Exactly. I want to extract two IP Address in the same event. And sorry for the <, in the viewer the symbol didn't work and the code worked :S

My question is more about create "named regex" and use these named regex in other regex.

0 Karma

Rob
Splunk Employee
Splunk Employee

Are you looking for the value of the ip_address field or are you looking to reference the regex of the ip_address field?

I am assuming that you want to capture 2 different fields that are in the same event that look like IP addresses and one follows the other?

0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...