topic Re: How to write the regex to extract this IP from my data? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-this-IP-from-my-data/m-p/217395#M63870 <P>Try something like this (run anywhere sample)</P> <PRE><CODE>| gentimes start=-1 | eval _raw="[2016-02-08T10:29:51.992-05:00] [octetstring] [TRACE] [] [com.octetstring.vde.DoSManager] [tid: 1841020] [ecid: 0000LB1RQ_gB9Dyso4P__m1MAxqb01VGWZ,0] [SRC_CLASS: com.octetstring.vde.util.VDELogger] [SRC_METHOD: debug] UnBind: cn=id,ou=applications,ou=example,ou=example,dc=eg,dc=com/54.16.26.209." | table _raw | rex "dc=\S+\/(?&lt;IPAddress&gt;\d+\.\d+\.\d+\.\d+)" </CODE></PRE> Wed, 24 Feb 2016 18:31:33 GMT somesoni2 2016-02-24T18:31:33Z How to write the regex to extract this IP from my data? https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-this-IP-from-my-data/m-p/217394#M63869 <P>Hello Team,</P> <P>I have the below log details and I need to extract only the IP that comes after <CODE>/</CODE>. Id remains same for all the commands.</P> <P>There is no proper field that includes dn, so its hard to extract based on any field.</P> <PRE><CODE>[2016-02-08T10:29:51.992-05:00] [octetstring] [TRACE] [] [com.octetstring.vde.DoSManager] [tid: 1841020] [ecid: 0000LB1RQ_gB9Dyso4P__m1MAxqb01VGWZ,0] [SRC_CLASS: com.octetstring.vde.util.VDELogger] [SRC_METHOD: debug] UnBind: cn=id,ou=applications,ou=example,ou=example,dc=eg,dc=com/54.16.26.209. </CODE></PRE> <P>Thanks,<BR /> Venkat</P> Wed, 24 Feb 2016 14:32:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-this-IP-from-my-data/m-p/217394#M63869 venkatalbert 2016-02-24T14:32:28Z Re: How to write the regex to extract this IP from my data? https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-this-IP-from-my-data/m-p/217395#M63870 <P>Try something like this (run anywhere sample)</P> <PRE><CODE>| gentimes start=-1 | eval _raw="[2016-02-08T10:29:51.992-05:00] [octetstring] [TRACE] [] [com.octetstring.vde.DoSManager] [tid: 1841020] [ecid: 0000LB1RQ_gB9Dyso4P__m1MAxqb01VGWZ,0] [SRC_CLASS: com.octetstring.vde.util.VDELogger] [SRC_METHOD: debug] UnBind: cn=id,ou=applications,ou=example,ou=example,dc=eg,dc=com/54.16.26.209." | table _raw | rex "dc=\S+\/(?&lt;IPAddress&gt;\d+\.\d+\.\d+\.\d+)" </CODE></PRE> Wed, 24 Feb 2016 18:31:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-write-the-regex-to-extract-this-IP-from-my-data/m-p/217395#M63870 somesoni2 2016-02-24T18:31:33Z