Regex - find second match?

cfortune — Sat, 09 Oct 2010 00:49:49 GMT

Was hoping I could get some help with extracting a field. I have a line that looks like:

"2010-10-08 16:04:10 0.0.0.0 21 3236 255.255.255.255 22821 2312 username 0 0 - 22 Back from VerifyPassword(user=username), bPasswordOK=1, iRetCode=0"

I want to extract the 255.255.255.255 as src_ip. I understand how to extract the field but I can't come up with a regex that extracts only that second IP address (as it's the source, first is the destination and is always the same, of course these are made up in this example. I don't have broadcast addresses logging into my server). I even downloaded regexbuddy but I still can't figure it out because I'm lame.

Any help would be greatly appreciated.

Re: Regex - find second match?

dwaddle — Sat, 09 Oct 2010 01:02:24 GMT

I think this will work - this is in transforms.conf style:

[mylookup]
REGEX=\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2} ([^\s]+) \d+ \d+ ([^\s]+)
FORMAT=src_ip::$2 dest_ip::$1

Re: Regex - find second match?

cfortune — Sat, 09 Oct 2010 01:48:28 GMT

Worked. Thanks man! Very quick response too.

topic Re: Regex - find second match? in Splunk Search

Regex - find second match?

Re: Regex - find second match?

Re: Regex - find second match?