https://community.splunk.com/t5/Getting-Data-In/How-to-write-rex-to-extract-multiple-Ips/m-p/629700#M107980 <P>Try&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">|rex field=Text max_match=0 "(?&lt;ip_address&gt;\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"</LI-CODE><P>&nbsp;</P><P>&nbsp;</P> Mon, 06 Feb 2023 10:42:24 GMT PaulPanther 2023-02-06T10:42:24Z https://community.splunk.com/t5/Getting-Data-In/How-to-write-rex-to-extract-multiple-Ips/m-p/629695#M107979 <P>I am trying to extract Ips from the field called Text, where this field contains Ips &amp; some string values ,&nbsp; this field not contains only one IP all time, it may contain 2 Ips , 3 or 5 or more than that.&nbsp; Ips will not be same for all the events and the string "value" is same for all the events</P> <P>eg.,</P> <P>Text= value 127.0.0.1,10.x.x.x, 10.x.x.1,10.x.x.3</P> <P>Text= value 145.X.X.2,&nbsp;19.x.x.3</P> <P>Text= value 123.X.X.X</P> <P>So, i need to extract only ip separetely(irrespective of count of Ips) and "value" in one field.</P> Mon, 06 Feb 2023 15:12:49 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-write-rex-to-extract-multiple-Ips/m-p/629695#M107979 nivets 2023-02-06T15:12:49Z https://community.splunk.com/t5/Getting-Data-In/How-to-write-rex-to-extract-multiple-Ips/m-p/629700#M107980 <P>Try&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">|rex field=Text max_match=0 "(?&lt;ip_address&gt;\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"</LI-CODE><P>&nbsp;</P><P>&nbsp;</P> Mon, 06 Feb 2023 10:42:24 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-write-rex-to-extract-multiple-Ips/m-p/629700#M107980 PaulPanther 2023-02-06T10:42:24Z