topic Re: srcip having numeric number in Getting Data In

srcip having numeric number

pavanbmishra — Thu, 05 Nov 2020 17:43:29 GMT

Hi All,

While analyzing the firewall logs, i could see src_ip (src) field taking some numeric number also alognwith actual ip address, sharing the below sample log where it is grabing src is 5864897 the numric one just after PASS.

Nov 5 17:37:57 abcxyz.com fwlogs:[27999] match PASS 5864897/5893553 IN 60 TCP 10.10.10.10/4655->10.20.20.20/443 S

I extracted field as below for src, still it is not getting parsed and taking numeric value. Kindly help

(TCP|FIN|RST|TIMEOUT)\s(?<srcip>\d+\.\d+\.\d+\.\d+)/

Re: srcip having numeric number

gcusello — Thu, 05 Nov 2020 17:58:21 GMT

Hi @pavanbmishra,

the problem is the final slash "/" that must be escaped:

| rex "(TCP|FIN|RST|TIMEOUT)\s(?<srcip>\d+\.\d+\.\d+\.\d+)\/"

that you can test at https://regex101.com/r/YTmopO/1

Ciao.

Giuseppe

Re: srcip having numeric number

pavanbmishra — Thu, 05 Nov 2020 18:08:29 GMT

Thanks gcusello,

I try this also, still no luck. same issue

Re: srcip having numeric number

gcusello — Fri, 06 Nov 2020 07:04:11 GMT

Hi @pavanbmishra,

probably your logs are different than the one you shared because the regex is correct:

Could you share other samples?

Ciao.

Giuseppe

Re: srcip having numeric number

pavanbmishra — Fri, 06 Nov 2020 07:19:49 GMT

Yeah it is, by the way many thanks for being helping hand

Even i try this and it is working on regex101 but not working under extracted field, here is the below sample log

Nov 6 07:13:43 xyz.com dflogs:[13223] match PASS 5864435/5893003 IN 52 TCP 10.10.10.10/62203->10.20.20.20/443 SEW

Also wanted to highlight that src and src_ip field ia already there and i am overwritting the regex using field extraction, would that work? or is there anything else i need to look into here.

Re: srcip having numeric number

gcusello — Fri, 06 Nov 2020 07:25:26 GMT

Hi @pavanbmishra,

I don't understand why you want to overwrite the srcip value, anyway, the regex is correct and runs also in Splunk not only in regex101

As i said probably there's something different in your logs.

Ciao.

Giuseppe

Re: srcip having numeric number

pavanbmishra — Fri, 06 Nov 2020 07:31:25 GMT

Yes gcusello , exactly it is working in Splunk as well.

Moto behind creating this filed extraction is there are some numeric values also being captured along with ip address. And i wanted to exclude those numeric values here. any suggestion would be highly appreciated here

Re: srcip having numeric number

gcusello — Fri, 06 Nov 2020 08:17:31 GMT

Hi @pavanbmishra,

could you explay better this new situation?

what do you mean with "there are some numeric values also being captured along with ip address"?

if you use my above regex you can only take values in IP4 format.

Ciao.

Giuseppe