topic Re: Extract second instance of IP address in Splunk Search

Extract second instance of IP address

Pmeiring — Mon, 19 Oct 2020 14:57:32 GMT

Hi All,

I'm currently in trying to extract the second IP address in each log as an field, but I'm simply not able to achive the desired results. The log differ quite variably and I'm unable to get a reliable pattern to "use" only the second match on IP address

REGEX query to grab match IP address

(?P<Public_IP_Test>\d+\.\d+\.\d+\.\d+)

Log Example

2020-10-19 14:13:54 12.23.34.45 POST /owa/service.svc action=FindItem&UA=0&ID=-18&AD=1&CorrelationID=e275e3c1-7ccb-4ac9-95a3-58550573648f_160312683455318;&ClientId=***************; 443 testing@domain.com 34.56.78.89 Mozilla/5.0+(iPhone;+CPU+iPhone+OS+13_3_1+like+Mac+OS+X)+AppleWebKit/605.1.15+(KHTML,+like+Gecko)+Version/13.0.5+Mobile/15E148+Safari/604.1 https://mail.domain.com/owa/ 200 0 0 124

Any assistance will be greatly appreciated

Re: Extract second instance of IP address

Azeemering — Mon, 19 Oct 2020 15:11:24 GMT

Try this: ^(?:[^ \n]* ){8}(?P<Public_IP_Test>[^ ]+)

Is this what you need?

Re: Extract second instance of IP address

inventsekar — Mon, 19 Oct 2020 15:53:55 GMT

Hi @Pmeiring ..this rex works fine.. (thanks to @Ayn for the rex)

| makeresults | eval log="2020-10-19 14:13:54 12.23.34.45 POST testing@domain.com 34.56.78.89" | rex field=log "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}.+?(?<ip_addr>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | table ip_addr

Re: Extract second instance of IP address

inventsekar — Mon, 19 Oct 2020 16:16:42 GMT

Hi @Azeemering for my learning, i tried this rex, but, somehow its giving error only.. starting with "^".. should i escape it or please format the rex query. thanks..

Re: Extract second instance of IP address

Azeemering — Mon, 19 Oct 2020 16:24:43 GMT

Try this in your search bar:

index=yourindex sourcetype=yoursourcetype | rex "^(?:[^ \n]* ){8}(?P<Public_IP_Test>[^ ]+)"

This works fine for me and extracts the second ip as the specified field

Re: Extract second instance of IP address

Pmeiring — Tue, 20 Oct 2020 06:46:40 GMT

Worked like a charm, irrespective of the log format

Thanks @inventsekar