topic Re: How do I write the regex to identify the sourceip that can be found in different locations in my logs? in Splunk Search

How do I write the regex to identify the sourceip that can be found in different locations in my logs?

splunkn — Tue, 21 Jun 2016 06:46:16 GMT

I have logs like below

1.1.1.1 This is my sourceip
2.2.2.2 My source ip is 1.1.1.2

I have a situation where in some events, my sourceip comes first in the line (AS in First EVENT), and other events, IPs come first, but this is not sourceip. Whatever comes after (in this case, 1.1.1.2) is my source ip. How to write a regex for this lookahead?

Thanks

Re: How do I write the regex to identify the sourceip that can be found in different locations in my logs?

tgdvopab — Tue, 21 Jun 2016 09:21:39 GMT

You can use two different regex:
for the first event: rex field=yourfield "^(?P(\d.){4})This is my sourceip"
for the 2nd even: rex field=youfield ".*My source ip is\s(?P(\d.){3}\d)"

Re: How do I write the regex to identify the sourceip that can be found in different locations in my logs?

javiergn — Tue, 21 Jun 2016 09:44:39 GMT

Try this:

| rex field=_raw max_match=0 "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| eval sourceIP = mvindex(ip, mvcount(ip)-1)

This is basically going to do the following:
- Store all the IPs in your event in the ip multivalued field (even if there's only one match, it will be a multivalued field with one value only)
- Retrieve the latest ip from the multivalued field and assign to sourceIP

Example:

| stats count | fields - count
| eval raw = "1.1.1.1 This is my sourceip; 2.2.2.2 My source ip is 1.1.1.2"
| eval raw = split(raw, ";")
| mvexpand raw
| rex field=raw max_match=0 "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| eval sourceIP = mvindex(ip, mvcount(ip)-1)

Output: see attached picture