topic RegEx AND / OR? in Splunk Search

RegEx AND / OR?

tmarlette — Wed, 07 Nov 2012 17:02:21 GMT

I am trying to extract an IP address into a field, however the same information occurs on two different logs, with two different logging methods.

I am attempting to extract the field with just one RegEx statement, but I can't seem to get the "AND" or "OR" portion of RegEx to recognize both data sets.

This is what I have:
src\s-\s(?\d+.\d+.\d+.\d+) OR DENIED\s-\s(?\d+.\d+.\d+.\d+)

I am attempting to extract the external IP address, from two different devices with 1 RegEx statement and put either 'hit' into the field "ext_ip".

here are the two message types:
DENIED - 10.10.10.10:8080 |
src - 10.10.10.10:8080

Does anyone know of a way to do this?

Re: RegEx AND / OR?

tmarlette — Wed, 07 Nov 2012 17:03:47 GMT

in the above RegEx statements, it keeps removing the backslash, so simply assume they are there in the RegEx statement above. 😃

Re: RegEx AND / OR?

axinjakson — Wed, 07 Nov 2012 17:53:38 GMT

You could try the built in Splunk extraction, since they are 2 different logs and logging methods, just extract the field "src_ip" in each, do a search including both log types and you will get the extracted results from both automagically.

http://docs.splunk.com/Documentation/Splunk/4.3.2/User/InteractiveFieldExtractionExample

Re: RegEx AND / OR?

sowings — Wed, 07 Nov 2012 18:20:20 GMT

It treats the backslash as an escape character. To get one to print within the body of the text, you'll have to use two together.

Re: RegEx AND / OR?

sowings — Wed, 07 Nov 2012 18:22:21 GMT

Given that that the difference is the prefix, and the formatting of the address is the same, I might do something like this:

(DENIED|src)\s-\s(?<ip_here>\d+\.\d+\.\d+\.\d+)

Re: RegEx AND / OR?

tmarlette — Wed, 07 Nov 2012 21:35:45 GMT

This worked perfectly!!! Thank you very much!

Re: RegEx AND / OR?

sowings — Thu, 08 Nov 2012 13:22:21 GMT

Consider accepting the answer if it helped you; in this way, others know that a good solution was found.

Re: RegEx AND / OR?

eashwar — Sat, 16 Mar 2013 19:28:01 GMT

hey there i hope this would help you.

D?E?N?I?E?D?s?r?c?\s-\s(?<ext_ip>d+.d+.d+.d+):\d{4}

Re: RegEx AND / OR?

kml_uvce — Sun, 17 Mar 2013 03:38:02 GMT

Even you can solve the problem like this, you can give one same field with 2 diffrent extraction based on DENIED and src from splunk Web Gui.

Kamal Bisht

Re: RegEx AND / OR?

sowings — Mon, 18 Mar 2013 17:05:27 GMT

Note that your regex above would allow for many different prefixes before the IP and port, like:

DEDrc -
EIE -
Dc -
DD -
ENDs -

etc.