topic Re: Extract IP address and user name for log in Splunk Search

Extract IP address and user name for log

tevgey23 — Fri, 17 May 2013 01:05:08 GMT

Im trying to extract the IP address in the [] and the user name which follows it.
I tried a few different regex with no success.,

Any recommendations ?

May 16 15:39:57 192.x.x.x Juniper: 2013-05-16 16:39:58 - ive - [24.x.x.x] bob_b(Company - OTP)[VIT Users] - Key Exchange number 1 occured for user with NCIP 192.x.x.x

Re: Extract IP address and user name for log

kml_uvce — Fri, 17 May 2013 01:25:01 GMT

Try these field extraction:

(?i) ive \- \[(?P<IP_Address>[^\]]+)
(?i) OTP\)\[(?P<User_Name>[^\]]+) when user is VIT Users

(?i)^[^\]]*\]\s+(?P<User_name>[^\(]+) when user is bob_b

Re: Extract IP address and user name for log

tevgey23 — Fri, 17 May 2013 01:34:55 GMT

Thank you for the reply. Seems to come up with an error

...| regex "(?i) ive - [(?P[^]]+)"

"Error in 'SearchOperator:regex': Usage: regex "(=|!=)

Re: Extract IP address and user name for log

kristian_kolb — Fri, 17 May 2013 07:04:49 GMT

Put this in your props.conf to get it all in one go. Assumes that the ip-address is inside the first set of square brackets in each event, and the username follows immediately after that (well, with a whitespace in between actually). The username can only contain A-Z, a-z, 0-9, - and _

[your sourcetype]
EXTRACT-get_stuff = ^[\[]+\[(?<ip_adress>[\]]+)\]\s+(?<user_name>[-\w]+)

Re: Extract IP address and user name for log

kml_uvce — Mon, 28 Sep 2020 13:55:51 GMT

try this

your search|rex field=_raw "(?i)[(?P[^]]+)"|rex field=_raw "(?i)^[^]]*]\s+(?P[^(]+)"

you can also combine these 2 fields in one rex.