topic Re: Regex for IP Address and URL in Splunk Search

Regex for IP Address and URL

prabmurthy — Sun, 10 Feb 2013 10:02:46 GMT

Hi,

I've 2 fields 1. Host with data which looks something like this ip-10-222-98-898, ip-10-982-83-821, ip-10-233-04-291 etc and other field (say Color) which has some text data example: Red, Yellow, White, Green.

I'd like to have something like this:

Column1 data should look like something like 10-222-98-898, 10-982-83-821 etc
Column2 data should look like http://10-982-83-821/Red (in this case 10-982-83-821 has field value red and so on..

What I was thinking was if I could get #1 ready then I can have a new variable say URL which will look something like URL=http://$host/$Color (I'm not sure of the syntax of how to fetch the fields but my try will look something like this)

How do I get started with #1 and any points for #2?

Thanks in advance.

Re: Regex for IP Address and URL

martin_mueller — Sun, 10 Feb 2013 12:48:38 GMT

Something like this:

...  | rex field=host "(?<ip>\d+-\d+-\d+-\d+)" | eval url = "http://".ip."/".color

If you want to replace the dashes in the host with dots you can throw in this:

... | eval ip = replace(ip, "-", ".") | ...

Re: Regex for IP Address and URL

prabmurthy — Sun, 10 Feb 2013 16:24:26 GMT

Thanks 🙂 That worked !!