How to extract field with rex?

[altink]

Dear All.

When searching some database log as
index=my_db ....
I have a field named "statement"  with content as example below:

The login packet used to open the connection is structurally invalid; the connection has been closed. Please contact the vendor of the client library. [CLIENT: 192.20.21.22]

I need to create a new field, named IP2, with the IP address as above.

In general, the rex command must look for the text between  "[CLIENT: " and "]"

Your help is appreciated

best regards
Altin

[altink]

I am not getting:

Why makeresults should be there
I have an existing field "statement" from which I need to get the IP, instead of a _raw one
Do not understand part "rename comment .." - I have no field named "comment"

referring to part
 eval raw="[CLIENT: 192.20.21.22]"

part 192.20.21.22 is NOT fixed,  it is just from the example above, it is variable - what I want to get as field IP2


regards
Altin

[bowesmana]

When people reply with solutions they will often post a block of code starting with | makeresults, which means this is an example which you can copy/paste to a Splunk search window and run to demonstrate the solution.

If you do that, you will see that it will create a dummy example and then extract a new field called IP2 with the address as need. The "rename..." is simply telling you that up to the final line, is an example setting up a solution for you.

As @kamlesh_vaghela has shown, the last line is the rex statement you need.

[altink]

Thank you for your answer too

regards
Altin

[kamlesh_vaghela · Accepted solution]

@altink 

Are you looking for this?

| makeresults 
| eval raw="[CLIENT: 192.20.21.22]"
| rename raw as _raw 
|rename comment as "upto this is sample data" 
| rex field=_raw "\[CLIENT:(?<IP2>.*)\]"

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

[altink]

Thank you very much for the solution

regards
Altin

ps. upvote is "accept as solution"?