Splunk Enterprise

How to filter ip from url

saurav47
Loves-to-Learn Lots

Hi All,

i want to filter out url that contains IP , one way is i can write regex for it,, extract IP in other field and then i can filter out with that field, but here i want to save run time as well,, as i dont have fixed index,, i need to search all indexes that are having field url with ip address,, so i want to apply search first instead of extracting ips. 

raw url formats are =http://1.1.1.1/, 1.1.1.1:443, http://1.1.1.1/xyc.co
 i tried so far 

(index=*)  |fields url |where match )url, "^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\")

it is working but only showing url as 1.1.1.1:443, not rest formats. 
any idea what can i do?

note: i dont want to write regex to extract IPs in new field first and than apply search (new field=*), it will work but query will take time as first it will search for all the urls,, then apply regex and then will apply filter.

Labels (1)
Tags (3)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You are anchoring the start of the string to match with ^

Try this example, where the regex matches an optional https at the start of the string

| makeresults
| eval url=split("http://1.1.1.1/,1.1.1.1:443,http://1.1.1.1/xyc.co,https://1.254.21.2221?q=abc,9.9.9.9.443", ",")
| mvexpand url
| where match(url, "(https?)?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}")
0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Transforming Financial Data into Fraud Intelligence

Every day, banks and financial companies handle millions of transactions, logins, and customer interactions ...

How to send events & findings from AWS to Splunk using Amazon EventBridge

Amazon EventBridge is a serverless service that uses events to connect application components together, making ...