Getting Data In

Regex exclude multiple subnets

eprovin
Explorer

I'm trying to filter out a couple subnets using regex. This works fine: | regex connection.ip != "^172.16.\d{1,3}.\d{1,3}$" but when I'm having troubles excluding another subnet.

This does not work for me: | regex connection.ip != "^172.16.\d{1,3}.\d{1,3}$|^10.10.\d{1,3}.\d{1,3}$"

Any suggestions?

Thanks!

Tags (1)
0 Karma
1 Solution

solarboyz1
Builder

Based on the example of /16 or /24, you could just use wildcard:

| search connection.ip!=172.16.* AND connection.ip!=10.10.*

or you could use cidrmatch if you need more complex matching:

| where NOT cidrmatch(172.16.0.0/16,connection.ip)

Or you might just try loosening up your regex, by removing the startline (^) and endline ($) markers, in case the value is space padded:

| regex connection.ip != "172.16.\d{1,3}.\d{1,3}|10.10.\d{1,3}.\d{1,3}"

View solution in original post

0 Karma

solarboyz1
Builder

Based on the example of /16 or /24, you could just use wildcard:

| search connection.ip!=172.16.* AND connection.ip!=10.10.*

or you could use cidrmatch if you need more complex matching:

| where NOT cidrmatch(172.16.0.0/16,connection.ip)

Or you might just try loosening up your regex, by removing the startline (^) and endline ($) markers, in case the value is space padded:

| regex connection.ip != "172.16.\d{1,3}.\d{1,3}|10.10.\d{1,3}.\d{1,3}"
0 Karma

eprovin
Explorer

Loosening the regex did seem to do the trick - thanks!

0 Karma

eprovin
Explorer

Thanks for the suggestion, but it still will only remove whichever filter is first. Any other ideas?

0 Karma

Sukisen1981
Champion

can we see the sample events and what you are trying to extract?

0 Karma

eprovin
Explorer

index="divit" sourcetype="pps_messagelog" final_module=spam final_rule="safe" | dedup msg.header.message-id{}
| transaction filter.qid
| regex connection.ip != "^172.16.\d{1,3}.\d{1,3}$"
| table _time,connection.sid,filter.qid,envelope.from,msg.header.to,subject,connection.ip,connection.host

0 Karma

richgalloway
SplunkTrust
SplunkTrust

We need to see sample data to know what regex string will match it.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Sukisen1981
Champion

i meant your event samples...we need to see the two subnets you refer to and why the second rex is failing

0 Karma

eprovin
Explorer

Sorry - newbie here. Is this what you're looking for?

  connection:   {   [-] 
     country:    eu 
     helo:   omp.save.spirit-airlines.com   
     host:   omp.save.spirit-airlines.com   
     ip:     12.130.136.48  
     protocol:   smtp:smtp  
     resolveStatus:  ok 
     sid:    2ubf9su5eg 
     tls:   {   [+] 
    }   
}   
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...