Splunk Enterprise

How to filter ip from url

Loves-to-Learn Lots

Hi All,

i want to filter out url that contains IP , one way is i can write regex for it,, extract IP in other field and then i can filter out with that field, but here i want to save run time as well,, as i dont have fixed index,, i need to search all indexes that are having field url with ip address,, so i want to apply search first instead of extracting ips. 

raw url formats are =,,
 i tried so far 

(index=*)  |fields url |where match )url, "^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\")

it is working but only showing url as, not rest formats. 
any idea what can i do?

note: i dont want to write regex to extract IPs in new field first and than apply search (new field=*), it will work but query will take time as first it will search for all the urls,, then apply regex and then will apply filter.

Labels (2)
Tags (3)
0 Karma


You are anchoring the start of the string to match with ^

Try this example, where the regex matches an optional https at the start of the string

| makeresults
| eval url=split(",,,,", ",")
| mvexpand url
| where match(url, "(https?)?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}")
0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...