Knowledge Management

How to extract client IPs in a different format than Splunk recognizes?

New Member

I am researching information into error log files and the way they're formatted is different so Splunk doesn't recognize the client ip addresses even though they're there and I have to format a report on the top 50 ip addresses, but I am not sure how to go about extracting them? Or if I need to add a new field?

As well, I had to format a list of the top 50 error types and it turned out that there were only 10 error types that covered all the log. But, when I went to record the count, when I added them all up, there was more than Splunk is showing as the count of the whole log file. I have double and triple checked, isolated each of the events and adding them up and even excluding one event and checking to see the amount left over. I can't seem to figure out what could be wrong.

Tags (1)
0 Karma


Any example for the raw events containing the IP address. At a basic level, the following regex will pick up IP addresses in dotted decimal format (e.g.


There is a more specific regex, as this would pick up subnet masks (e.g. if they exist.

0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

Splunk Cloud Platform | New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...