topic Re: How can i get ip address from postfix logs in Splunk Search

How can i get ip address from postfix logs

saito0910 — Fri, 18 Apr 2014 05:01:12 GMT

Hi,

How can i get ip address from like under log??

---
Sep 13 23:55:42 mailhost1 postfix/smtpd[15824]: [ID 197553 mail.info] connect from example.com[1.1.1.1]
---

I use search command "host=mailhost1 | top limit=100 client ",
and result is "example.com[1.1.1.1]".(source type is postfix_syslog)

I need only ip address to use geoip.

thanks

MuS — Fri, 18 Apr 2014 05:58:52 GMT

Hi saito0910,

try something like this:

host=mailhost1 | rex field=client "(?<myIP>(\d+\.){3}\d+)]$" | top limit=100 myIP

this will get the IP form the client field and returns it as new field myIP

hope this helps ...

cheers, MuS

saito0910 — Fri, 18 Apr 2014 07:48:03 GMT

Thanks MuS! That worked well! 🙂