topic Regex for last IP Address in Splunk Search

Regex for last IP Address

VS0909 — Tue, 07 Sep 2021 04:51:10 GMT

Can someone please help with the Splunk query for the below scenario:

I want to extract last IP address by a regular expression (regex) , for an event which has one or more IP addresses.

If the event has one IP ---> then extract that IP

If the event has more than one IP ---> then extract the last IP

Thanks!

Re: Regex for last IP Address

VS0909 — Tue, 07 Sep 2021 10:41:23 GMT

Can someone please help with the Splunk query for the below scenario:

I want to extract last IP address by a regular expression (regex) , for an event which has one or more IP addresses.

If the event has one IP ---> then extract that IP

If the event has more than one IP ---> then extract the last IP

Thanks!

Re: Regex for last IP Address

scelikok — Tue, 07 Sep 2021 16:03:02 GMT

Hi @VS0909,

You can try below;

rex "(?!.+\s\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

Re: Regex for last IP Address

ITWhisperer — Tue, 07 Sep 2021 18:55:18 GMT

Can you share some example events to clarify how the last ip address might appear?

Re: Regex for last IP Address

PickleRick — Tue, 07 Sep 2021 19:45:06 GMT

(?<ip>\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b)(?!.*\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b)

Ugly as hell, and of course doesn't check for validity of the IP (accepts any 1-3 digit sequences, even ridiculous like 345.912.123.0). Regex is not the best tool to validate IP-s

Re: Regex for last IP Address

PickleRick — Tue, 07 Sep 2021 19:46:50 GMT

Close, but your regex will match the first ip on the line, not the last one.