Archive
Highlighted

Query logs with IP and not domain name from a field in Splunk

Engager

Hi- I am trying to search through logs and looking for requests that are using IPs(IPv4) rather than domain name. How do I perform such query from a field, X?

For example:
111.222.333.444/abc.txt
myexample.com/xyz.txt

I want to look for logs with fields like line 1 and not line 2.

Thanks,
MA

Tags (1)
0 Karma
Highlighted

Re: Query logs with IP and not domain name from a field in Splunk

SplunkTrust
SplunkTrust

This will test whether an ip address is anywhere in HostFieldName

... | eval n=if(match(HostFieldName,"\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"), 1,0)

so, it would match WE123.456.789.012FX as well as your examples.

With minor adjustments, you could also use it something like this -

... | search match(HostFieldName,"\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}")
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.