topic Re: negative regex in search command in Splunk Search

negative regex in search command

AdrienW — Mon, 23 Jan 2012 09:38:05 GMT

Dear,

I have some issue with a regular expression in a search command.
I have in a log a field called "src" with some IP in value of this field.
I succeeded to match the IP wich begin with 192 with this command :

rex .*nosrc=(?192\.\d+\.\d+\.\d+).*

Now I would like to match all the IP that DOES NOT begin with 192. How do I can do?

Is the "^" character recognised by Splunk?

Regards,

Re: negative regex in search command

Ayn — Mon, 23 Jan 2012 09:53:28 GMT

It seems some of your text got lost in the formatting. I'm assuming your search looks something like:

... | rex ".*nosrc=(?<somefieldname>192\.\d+\.\d+\.\d+).*"

First of all, you don't need the leading and trailing .*. Splunk will match that automatically. Second, if all you need is a specific regex matching any IP numbers that do not begin with 192, this should work:

... | rex "nosrc=(?<somefieldname>19[^2]\.\d+\.\d+\.\d+)

That said, the approach is kind of weird and it might be better to just match all IP's in general and instead apply this kind of filtering separately once the field has been extracted. My suggestion would be to do something like

... | rex "nosrc=(?<somefieldname>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) | search NOT somefieldname="192.*"

Re: negative regex in search command

AdrienW — Mon, 23 Jan 2012 10:04:19 GMT

I tried with your first answer :

index="index" sourcetype="my_sourcetype" | rex "src=(?<ip>19[^2]\.\d+\.\d+\.\d+)" | stats count(ip) by ip

That doesn't match anything, but

rex "src=(?<ip>192\.\d+\.\d+\.\d+)"

return 192.XXX values.

Do you know why?

Re: negative regex in search command

AdrienW — Mon, 23 Jan 2012 10:19:57 GMT

Here is the return when I match all the IP of the field src on my index with the command :

stats count(src) by src

When I use this command I got only 2 values returned :

rex "src=(?<ip>\d{3}\.\d{3}\.\d{3}\.\d{3})" | search NOT ip="192.*" | stats count(ip) by ip

wich are : 109.202.232.150 // 169.254.144.215

Re: negative regex in search command

Drainy — Mon, 23 Jan 2012 11:14:40 GMT

Because the regex is looking for anything that starts with a 19 but not 192. What I would do is probably rex all IP's and then use a pipe to where to filter out the 192 addresses

Re: negative regex in search command

Ayn — Mon, 23 Jan 2012 11:26:26 GMT

Oops! My regex was wrong. Editing my answer.

Re: negative regex in search command

Drainy — Mon, 23 Jan 2012 12:34:38 GMT

Hah, I didn't even look at your final rex suggestion!

Re: negative regex in search command

AdrienW — Mon, 23 Jan 2012 12:44:59 GMT

Thanks for your edit.

My last question is about the way to encapsulate all the reg to build this graph :

I have to match all the IP begining with 192 (dark green), all the IP without 192 (light green) and build a graph like this.
But I think I can't with the "search NO ip=192.*" command because it filter at the end no?

I would like if it's possible to do the 2 commands like :

command01(only 192) AS inbound command02(only without 192) AS outbound | timechart ......

Is it possible?

Re: negative regex in search command

Ayn — Mon, 23 Jan 2012 13:02:22 GMT

Sure. I would use eval for this. The process would be to first extract the field containing the IP address, then use eval for determining whether the IP address is internal or external and write the result to a field, and finally feed this into timechart.

... | rex "src=(?<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | eval conntype=if(match(src_ip,"^192"),"Outbound","Inbound") | timechart span=1d count by conntype

You could also build this into timechart directly:

... | rex "src=(?<src_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | timechart span=1d count(eval(match(src_ip,"^192"))) AS Outbound, count(eval(match(src_ip,"^19[^2]"))) AS Inbound

NOTE: I didn't cover the case of purely internal traffic, but that's just a matter of extracting both the source and destination IP and adding the case where they both are considered to be internal. Also NOTE that you shouldn't just be testing whether the address begins with 192, lots of public Internet addresses begin with 192 as well. You should be checking for 192.168.

Re: negative regex in search command

AdrienW — Mon, 23 Jan 2012 13:38:49 GMT

You're right, I'll check for the 192.168.

Thanks !