topic Re: How to create a regex to extract the first IP address from multiple IP addresses in an event line? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-to-extract-the-first-IP-address-from/m-p/420845#M120930 <P>worked by removing .+ at the end ...</P> Wed, 12 Jun 2019 18:19:53 GMT reverse 2019-06-12T18:19:53Z How to create a regex to extract the first IP address from multiple IP addresses in an event line? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-to-extract-the-first-IP-address-from/m-p/420842#M120927 <P>There are multiple ip addresses in a raw event line and I only need the first one <BR /> How can I achieve that?</P> <PRE><CODE>192.168.0.1 -192.168.0.5 gcgh 192.168.0.7gcgh 192.168.0.7 gcgh 192.168.0.8 gcgh 192.168.0.9 gcgh </CODE></PRE> Wed, 12 Jun 2019 18:02:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-to-extract-the-first-IP-address-from/m-p/420842#M120927 reverse 2019-06-12T18:02:39Z Re: How to create a regex to extract the first IP address from multiple IP addresses in an event line? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-to-extract-the-first-IP-address-from/m-p/420843#M120928 <P>Something like that:</P> <PRE><CODE>([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\/*\d*).+ </CODE></PRE> Wed, 12 Jun 2019 18:07:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-to-extract-the-first-IP-address-from/m-p/420843#M120928 felipesewaybric 2019-06-12T18:07:10Z Re: How to create a regex to extract the first IP address from multiple IP addresses in an event line? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-to-extract-the-first-IP-address-from/m-p/420844#M120929 <P>not working .. i tried here <BR /> <A href="https://regex101.com/r/2MblRX/1">https://regex101.com/r/2MblRX/1</A></P> Wed, 12 Jun 2019 18:13:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-to-extract-the-first-IP-address-from/m-p/420844#M120929 reverse 2019-06-12T18:13:09Z Re: How to create a regex to extract the first IP address from multiple IP addresses in an event line? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-to-extract-the-first-IP-address-from/m-p/420845#M120930 <P>worked by removing .+ at the end ...</P> Wed, 12 Jun 2019 18:19:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-to-extract-the-first-IP-address-from/m-p/420845#M120930 reverse 2019-06-12T18:19:53Z Re: How to create a regex to extract the first IP address from multiple IP addresses in an event line? https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-to-extract-the-first-IP-address-from/m-p/420846#M120931 <P>Adding context for anyone coming here for answers.</P> <P>Assuming msg is the field name, the following would result in the first IP found</P> <PRE><CODE>| makeresults | eval msg = "192.128.22.2 202.134.55.89" | rex field=msg "(?&lt;firstip&gt;\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" </CODE></PRE> <P>If additional IPs needed to be extracted then a max_match = # could be added to the rex line. </P> Wed, 12 Jun 2019 18:42:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-regex-to-extract-the-first-IP-address-from/m-p/420846#M120931 jazzypai 2019-06-12T18:42:14Z