How to exclude private ip address range based on the result of "rex max_match"

[haiweichen]

I run this query to extract all IP address from the events. There are multi ip based on one event.

index=*
| rex max_match=0 field=_raw "(?<ipaddr>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| dedup ipaddr
| table _time, ipaddr

The result is as below,

Capture.PNG

My question is, how to exclude private IP from the the result? Thanks!

[richgalloway]

use the mvfilter function to remove unwanted values from a multi--value field.

| rex max_match=0 field=_raw "(?<ipaddr>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| eval ipaddr=mvdedup(mvfilter(match(ipaddr,"10\..*")))
| table _time, ipaddr

Also, use mvdedup instead of dedup on multi-value fields.

[haiweichen · Accepted solution]

Thanks, mvfilter works for my case.