topic Re: How to extract only IP's from text? in Splunk Search

How to extract only IP's from text?

harishnpandey — Tue, 14 Aug 2018 19:26:32 GMT

trans(776800911)[10.173.36.75]: Request processing failed: Network Error, from URL: 10.173.36.73:57743
trans(776800912)[10.173.36.75]: Request processing failed: Network Error, from URL: 10.173.36.74:57743
trans(776800913)[10.173.36.75]: Request processing failed: Network Error, from URL: 10.173.36.75:57743

Re: How to extract only IP's from text?

somesoni2 — Tue, 14 Aug 2018 19:59:44 GMT

Try like this

If this is to be extracted from raw data (_raw field),

your search 
| rex "URL\:\s*(?<IP_Address>\d+\.\d+\.\d+\.\d+)"

If this is to be extracted from some other field (for example from field name "Message"),

your search 
| rex field=Message "URL\:\s*(?<IP_Address>\d+\.\d+\.\d+\.\d+)"

Re: How to extract only IP's from text?

harishnpandey — Tue, 14 Aug 2018 20:04:05 GMT

Thanks a lot for quick response. It really helps

Re: How to extract only IP's from text?

harishnpandey — Tue, 14 Aug 2018 20:04:40 GMT

Could you please explain how this works ==> \s*(?\d+.\d+.\d+.\d+)

Re: How to extract only IP's from text?

jkat54 — Tue, 14 Aug 2018 22:42:31 GMT

See regex101.com

 \s = space
 \d+ = any number of digits
 \. = dot

This regex could identify non-ip addresses too. For example, it would match 1234.5678.9012.34567890 too, which is clearly not an up address.