Getting Data In

Regex exclude multiple subnets

eprovin
Explorer

I'm trying to filter out a couple subnets using regex. This works fine: | regex connection.ip != "^172.16.\d{1,3}.\d{1,3}$" but when I'm having troubles excluding another subnet.

This does not work for me: | regex connection.ip != "^172.16.\d{1,3}.\d{1,3}$|^10.10.\d{1,3}.\d{1,3}$"

Any suggestions?

Thanks!

Tags (1)
0 Karma
1 Solution

solarboyz1
Builder

Based on the example of /16 or /24, you could just use wildcard:

| search connection.ip!=172.16.* AND connection.ip!=10.10.*

or you could use cidrmatch if you need more complex matching:

| where NOT cidrmatch(172.16.0.0/16,connection.ip)

Or you might just try loosening up your regex, by removing the startline (^) and endline ($) markers, in case the value is space padded:

| regex connection.ip != "172.16.\d{1,3}.\d{1,3}|10.10.\d{1,3}.\d{1,3}"

View solution in original post

0 Karma

solarboyz1
Builder

Based on the example of /16 or /24, you could just use wildcard:

| search connection.ip!=172.16.* AND connection.ip!=10.10.*

or you could use cidrmatch if you need more complex matching:

| where NOT cidrmatch(172.16.0.0/16,connection.ip)

Or you might just try loosening up your regex, by removing the startline (^) and endline ($) markers, in case the value is space padded:

| regex connection.ip != "172.16.\d{1,3}.\d{1,3}|10.10.\d{1,3}.\d{1,3}"

View solution in original post

0 Karma

eprovin
Explorer

Loosening the regex did seem to do the trick - thanks!

0 Karma

eprovin
Explorer

Thanks for the suggestion, but it still will only remove whichever filter is first. Any other ideas?

0 Karma

Sukisen1981
Champion

can we see the sample events and what you are trying to extract?

0 Karma

eprovin
Explorer

index="divit" sourcetype="pps_messagelog" final_module=spam final_rule="safe" | dedup msg.header.message-id{}
| transaction filter.qid
| regex connection.ip != "^172.16.\d{1,3}.\d{1,3}$"
| table _time,connection.sid,filter.qid,envelope.from,msg.header.to,subject,connection.ip,connection.host

0 Karma

richgalloway
SplunkTrust
SplunkTrust

We need to see sample data to know what regex string will match it.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Sukisen1981
Champion

i meant your event samples...we need to see the two subnets you refer to and why the second rex is failing

0 Karma

eprovin
Explorer

Sorry - newbie here. Is this what you're looking for?

  connection:   {   [-] 
     country:    eu 
     helo:   omp.save.spirit-airlines.com   
     host:   omp.save.spirit-airlines.com   
     ip:     12.130.136.48  
     protocol:   smtp:smtp  
     resolveStatus:  ok 
     sid:    2ubf9su5eg 
     tls:   {   [+] 
    }   
}   
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!