topic Need to pull IP from Message field in Splunk Search

Need to pull IP from Message field

radalliance — Fri, 16 Jul 2021 14:40:39 GMT

Hey all, I'm trying to separate out the IP address (Source Network Address:) from the Windows event Message field. I'm trying to find every instance of authentication for a certain user acct (including services & IIS app pools), but I'm having to parse it from the logs I'm getting from our Domain controllers.

I'm pretty new to Splunk so my search is fairly basic. This is all I have so far, and I haven't been able to find info on whether that rex field should equal the new field I'm trying to create, or the field I'm searching, or what:

index=* user=username EventCode=4740 OR EventCode=4648 OR EventCode=4672 OR EventCode=4624 | rex field=ServerIP "Source Network Address:(?<Message>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

So what I'm trying to do:

Search Windows event log "Message" field > Find string "Source Network Address:ipaddress"

Create new field with Value being above IP address

Appreciate any help!

Re: Need to pull IP from Message field

gcusello — Fri, 16 Jul 2021 14:50:01 GMT

Hi @radalliance,

are you sure that you already haven't that field? I have in my logs with the field name "IpAddress"

Anyway, with this regex I'm able to extract it:

| rex "(?<IP>\d+\.\d+\.\d+\.\d+)"

Ciao.

Giuseppe

Re: Need to pull IP from Message field

radalliance — Fri, 16 Jul 2021 15:18:01 GMT

Perfect, thank you. Removed the extra eventID search and was able to return just what I needed with the following:

Re: Need to pull IP from Message field

gcusello — Fri, 16 Jul 2021 15:19:48 GMT

Hi @radalliance,

good for you, see next time.

Ciao and happy splunking.

Giuseppe.

P.S.: Karma Points are appreciated 😉