topic Re: How to edit my regular expression to extract the last IP from my sample string using rex? in Splunk Search

How to edit my regular expression to extract the last IP from my sample string using rex?

bakalon — Tue, 25 Oct 2016 19:19:28 GMT

Hey Guys,

I have the following output:

Server: abc-ij-qwerty88.asdf.xyz.com Address: 10.10.254.97 DNS request timed out. timeout was 2 seconds. DNS request timed out. timeout was 2 seconds. Name: google.com Address: 172.217.20.46

I'd like to extract the Last IP from the string.

I tried the following search with rex, but it returns a blank result:

.... | rex field=_raw "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$)" | table  ip_address

Where did I go wrong?

Your help is appreciated. Thanks!

Re: How to edit my regular expression to extract the last IP from my sample string using rex?

somesoni2 — Tue, 25 Oct 2016 19:29:06 GMT

You were almost there. Use like this

.... | rex field=_raw "(?<ip_address>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$" | table  ip_address

Re: How to edit my regular expression to extract the last IP from my sample string using rex?

gokadroid — Tue, 25 Oct 2016 19:29:38 GMT

you did not put the name of the tag ?<ip_address> which you are tabl(ing)

 .... | rex field=_raw "(?<ip_address>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$" | table  ip_address

Re: How to edit my regular expression to extract the last IP from my sample string using rex?

sundareshr — Tue, 25 Oct 2016 19:34:27 GMT

There's probably a LF at the end. Try this

... | rex "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})[\n\t\s]$" | ...

Re: How to edit my regular expression to extract the last IP from my sample string using rex?

inventsekar — Tue, 25 Oct 2016 19:38:27 GMT

just move the "$" outside the rex match.

Rex match should be inside parentheses "(.....)",
and to position the rex match, we can use this anchor "$", (which means at the end of line, ...opposite of "^" - beginning of the line)

 .... | rex field=_raw "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$" | table  ip_address

Re: How to edit my regular expression to extract the last IP from my sample string using rex?

bakalon — Wed, 26 Oct 2016 11:34:27 GMT

Thank you! This worked for me. What did you mean by an "LF" at the end?

Re: How to edit my regular expression to extract the last IP from my sample string using rex?

bakalon — Wed, 26 Oct 2016 11:35:02 GMT

I had tried this earlier, but it didn't work for me. Thanks for taking the time to help me!

Re: How to edit my regular expression to extract the last IP from my sample string using rex?

bakalon — Wed, 26 Oct 2016 11:35:57 GMT

Sorry, yeah I did use the tag but somehow forgot it when making this post. I tried your query but it produced the same blank results. The first answer solved my issue. Thanks!

Re: How to edit my regular expression to extract the last IP from my sample string using rex?

bakalon — Wed, 26 Oct 2016 11:37:02 GMT

Thanks for your help! This didn't work, but the inclusion of [\n\t\s] at the end (1st answer) worked for me. Thanks again for your help.

Re: How to edit my regular expression to extract the last IP from my sample string using rex?

sundareshr — Wed, 26 Oct 2016 11:39:28 GMT

Line feed. or line break