topic Re: How to exclude private ip address range based on the result of "rex max_match" in Getting Data In

How to exclude private ip address range based on the result of "rex max_match"

haiweichen — Wed, 27 Jul 2022 23:59:37 GMT

I run this query to extract all IP address from the events. There are multi ip based on one event.

index=*
| rex max_match=0 field=_raw "(?<ipaddr>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| dedup ipaddr
| table _time, ipaddr

The result is as below,

Capture.PNG

My question is, how to exclude private IP from the the result? Thanks!

Re: How to exclude private ip address range based on the result of "rex max_match"

richgalloway — Thu, 28 Jul 2022 00:10:06 GMT

use the mvfilter function to remove unwanted values from a multi--value field.

| rex max_match=0 field=_raw "(?<ipaddr>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | eval ipaddr=mvdedup(mvfilter(match(ipaddr,"10\..*"))) | table _time, ipaddr

Also, use mvdedup instead of dedup on multi-value fields.

Re: How to exclude private ip address range based on the result of "rex max_match"

haiweichen — Thu, 28 Jul 2022 00:29:24 GMT

Thanks, mvfilter works for my case.