srcip having numeric number

[pavanbmishra]

Hi All,

While analyzing the firewall logs, i could see src_ip (src) field taking some numeric number also alognwith actual ip address, sharing the below sample log where it is grabing src is 5864897 the numric one just after PASS. 

Nov 5 17:37:57 abcxyz.com fwlogs:[27999] match PASS 5864897/5893553 IN 60 TCP 10.10.10.10/4655->10.20.20.20/443 S

I extracted field as below for src, still it is not getting parsed and taking numeric value. Kindly help

(TCP|FIN|RST|TIMEOUT)\s(?<srcip>\d+\.\d+\.\d+\.\d+)/

[pavanbmishra]

Thanks gcusello,

I try this also, still no luck. same issue

[gcusello · Accepted solution]

Hi @pavanbmishra,

probably your logs are different than the one you shared because the regex is correct:

Could you share other samples?

Ciao.

Giuseppe

[pavanbmishra]

Yeah it is, by the way many thanks for being helping hand

Even i try this and it is working on regex101 but not working under extracted field, here is the below sample log

Nov 6 07:13:43 xyz.com dflogs:[13223] match PASS 5864435/5893003 IN 52 TCP 10.10.10.10/62203->10.20.20.20/443 SEW

Also wanted to highlight that src and src_ip field ia already there and i am overwritting the regex using field extraction, would that work? or is there anything else i need to look into here.

[gcusello]

Hi @pavanbmishra,

I don't understand why you want to overwrite the srcip value, anyway, the regex is correct and runs also in Splunk not only in regex101

As i said probably there's something different in your logs.

Ciao.

Giuseppe

[pavanbmishra]

Yes  gcusello , exactly it is working in Splunk as well. 

Moto behind creating this filed extraction is there are some numeric values also being captured along with ip address.  And i wanted to exclude those numeric values here. any suggestion would be highly appreciated here

[gcusello]

Hi @pavanbmishra,

could you explay better this new situation?

what do you mean with "there are some numeric values also being captured along with ip address"?

if you use my above regex you can only take values in IP4 format.

Ciao.

Giuseppe

[gcusello]

Hi @pavanbmishra,

the problem is the final slash "/" that must be escaped:

| rex "(TCP|FIN|RST|TIMEOUT)\s(?<srcip>\d+\.\d+\.\d+\.\d+)\/"

that you can test at https://regex101.com/r/YTmopO/1

Ciao.

Giuseppe