topic Re: How to extract first ip from "http_x_forwarded_for="222.xx.xx.xx, 122.211.xx.xx" using rex in splunk in Splunk Search

How to extract first ip from "http_x_forwarded_for="222.xx.xx.xx, 122.211.xx.xx" using rex in Splunk search?

minhquannguyen7 — Tue, 11 Jul 2023 14:40:12 GMT

here is field "http_x_forwarded_for="222.xx.xx.xx, 122.211.xx.xx"

i have try:

| rex field=_raw "http_x_forwarded_for\s*=\s*(?<ip_address>[^,\s]+)"

| table ip_address

But it not works, pls help !

santoshneelam — Tue, 11 Jul 2023 07:54:32 GMT

|rex "(?im)\w+\=\"(?P<http_x_forwarded_for>.[^\,]+)"

or else
|rex "(?im)\w+\=\"(?P<http_x_forwarded_for>\d+\.\d+\.\d+\.\d+)"

minhquannguyen7 — Tue, 11 Jul 2023 10:00:30 GMT

thanks you @santoshneelam ! i want extract in the different log with any field look like this , what shoud i do ???