topic Re: How to retrieve unique IP address from access log through splunk ? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-retrieve-unique-IP-address-from-access-log-through-splunk/m-p/155108#M43638 <P>thnx.. It worked</P> Thu, 08 May 2014 17:08:16 GMT veeru_irf 2014-05-08T17:08:16Z How to retrieve unique IP address from access log through splunk ? https://community.splunk.com/t5/Splunk-Search/How-to-retrieve-unique-IP-address-from-access-log-through-splunk/m-p/155104#M43634 <P>HI <BR /> I am trying to extract Unique IP address from access log to determine the user load.</P> <P>My request looks like as below<BR /> - - [01/May/2014:08:59:49 -0700] POST /connect/group/home/support-query1?p_p_id=myexample_WAR_dsp&amp;p_p_lifecycle=2&amp;p_p_state=normal&amp;p_p_mode=view&amp;p_p_cacheability=cacheLevelPage&amp;p_p_col_id=column-1&amp;p_p_col_count=1&amp;action=dispatch HTTP/1.0 200 126 05507 5164</P> Mon, 28 Sep 2020 16:33:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-retrieve-unique-IP-address-from-access-log-through-splunk/m-p/155104#M43634 veeru_irf 2020-09-28T16:33:04Z Re: How to retrieve unique IP address from access log through splunk ? https://community.splunk.com/t5/Splunk-Search/How-to-retrieve-unique-IP-address-from-access-log-through-splunk/m-p/155105#M43635 <P>There is no IP in this log? Does your web server log the IP's for requests at all?</P> Wed, 07 May 2014 05:31:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-retrieve-unique-IP-address-from-access-log-through-splunk/m-p/155105#M43635 MuS 2014-05-07T05:31:28Z Re: How to retrieve unique IP address from access log through splunk ? https://community.splunk.com/t5/Splunk-Search/How-to-retrieve-unique-IP-address-from-access-log-through-splunk/m-p/155106#M43636 <P>Sorry missed out initial part<BR /> 205.140.227.154 - - [01/May/2014:08:59:49 -0700] POST /connect/group/home/support-query1?p_p_id=myexample_WAR_dsp&amp;p_p_lifecycle=2&amp;p_p_state=normal&amp;p_p_mode=view&amp;p_p_cacheability=cacheLevelPage&amp;p_p_col_id=column-1&amp;p_p_col_count=1&amp;action=dispatch HTTP/1.0 200 126 05507 5164</P> Mon, 28 Sep 2020 16:33:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-retrieve-unique-IP-address-from-access-log-through-splunk/m-p/155106#M43636 veeru_irf 2020-09-28T16:33:07Z Re: How to retrieve unique IP address from access log through splunk ? https://community.splunk.com/t5/Splunk-Search/How-to-retrieve-unique-IP-address-from-access-log-through-splunk/m-p/155107#M43637 <P>Hi veeru_irf,</P> <P>try something like this:</P> <PRE><CODE>your base search here | rex "^(?&lt;myIP&gt;(\d+\.){3}(\d+))" | table myIP </CODE></PRE> <P>If this matches, you can set it up as automatic <A href="http://docs.splunk.com/Documentation/Splunk/6.1/Knowledge/Addfieldsatsearchtime">field extraction</A> so it will be extracted by Splunk directly.<BR /> Also here is a nice little <A href="http://regexr.com/v1/">page</A> where you can test regex stuff </P> <P>hope this helps to get you started ...</P> <P>cheers, MuS</P> Wed, 07 May 2014 05:56:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-retrieve-unique-IP-address-from-access-log-through-splunk/m-p/155107#M43637 MuS 2014-05-07T05:56:34Z Re: How to retrieve unique IP address from access log through splunk ? https://community.splunk.com/t5/Splunk-Search/How-to-retrieve-unique-IP-address-from-access-log-through-splunk/m-p/155108#M43638 <P>thnx.. It worked</P> Thu, 08 May 2014 17:08:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-retrieve-unique-IP-address-from-access-log-through-splunk/m-p/155108#M43638 veeru_irf 2014-05-08T17:08:16Z