topic Parsing a field, how can I tell if the value is an IP or a hostname (string)? in Getting Data In

Parsing a field, how can I tell if the value is an IP or a hostname (string)?

reswob4 — Fri, 29 Apr 2016 17:33:49 GMT

If I parse out a field, how can I tell if the value is an IP or a hostname?

timestamp host error: Auth fail user1 from 1.2.3.4
timestamp host error: Auth fail user2 from host.machine.com

While it's easy to put that last info into a field called source,

EXTRACT-user,source = error: Auth fail (?<user>.+?) from (?<source>.+)

I need to find out if the source is an IP or a hostname.

What is the syntax in props.conf to do that?

Re: Parsing a field, how can I tell if the value is an IP or a hostname (string)?

woodcock — Fri, 29 Apr 2016 17:44:05 GMT

Like this:

error: Auth fail (?:(?<user>.+?) from (?<source_ip>\d+\.\d+\.\d+\.\d+)|(?<source_hostname>.+))

Re: Parsing a field, how can I tell if the value is an IP or a hostname (string)?

acharlieh — Tue, 29 Sep 2020 09:35:08 GMT

You might be able to use alternation to optionally extract an additional field (I haven't tried this in Splunk yet, but the theory goes like this):

EXTRACT-user,source,ip_source = error : Auth fail (?<user>\S+) from (?<source>(?<ip_source>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})|.+))

(Yes that is an overly broad match for an ipv4 address but bear with me here)

When you have an ipaddress you will have an extra field called ip_source, when you do not, you won't. So you can then test if the ip_source field is populated or null will tell you if the source is an ip address or not.