topic Re: Rex Question in Splunk Search

Rex Question

ho000dor — Fri, 24 Oct 2014 18:25:14 GMT

Hi,

Does anyone know what i need to put in between these two fields in order to make the query continue on the ip2 if ip1 is found on a single log event? Sometimes there may not be an ip2... \s+ is what i have currently.

| rex "(?i)(?<ip1>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+(?<ip2>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

Re: Rex Question

richgalloway — Fri, 24 Oct 2014 18:26:55 GMT

Please post a sample of your data.

Re: Rex Question

sk314 — Fri, 24 Oct 2014 18:41:56 GMT

hodor

also sample data.

Re: Rex Question

ho000dor — Fri, 24 Oct 2014 18:47:50 GMT

It could vary.

Anything from:

192.168.1.1 4.2.2.2 blah blah other stuff 

or 

otherstuff 192.168.1.1 blah blah

or 

otherstuff blah blah 192.168.1.1 blah blah 4.2.2.2 otherstuff

ip2 can be null if there isn't a second IP. Is that possible or do i have to set up a second | rex?

Re: Rex Question

sk314 — Mon, 28 Sep 2020 17:57:49 GMT

have you tried this rex max_match=2 field=_raw " (?i)(?\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})*" with max_match parameter set to 2 as mentioned in this http://answers.splunk.com/answers/47381/how-to-extract-all-matching-values-from-an-event-using-regex.html

Re: Rex Question

somesoni2 — Fri, 24 Oct 2014 19:29:02 GMT

Try this (run anywhere sample, before rex part is to generate sample data)

|gentimes start=-1 | eval temp="192.168.1.1 4.2.2.2 blah blah other stuff #otherstuff 192.168.1.1 blah blah#otherstuff blah blah 192.168.1.1 blah blah 4.2.2.2 otherstuff" | table temp | makemv temp delim="#" | mvexpand temp | rename temp as _raw 
| rex "(?i)(?<ip1>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})(.*(?<ip2>(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}))|.*)"

Re: Rex Question

ho000dor — Fri, 24 Oct 2014 19:29:29 GMT

That's exactly what i'm looking for! Thanks a lot!

Re: Rex Question

ho000dor — Fri, 24 Oct 2014 19:32:13 GMT

Thanks a lot!

Re: Rex Question

martin_mueller — Fri, 24 Oct 2014 20:03:08 GMT

It'd be nice for future generations to accept the answer that solved the problem instead. Then others can immediately see the solution if they have similar questions rather than guessing what's the solution.