Splunk Enterprise

How to filter ip from url

saurav47
Loves-to-Learn Lots

Hi All,

i want to filter out url that contains IP , one way is i can write regex for it,, extract IP in other field and then i can filter out with that field, but here i want to save run time as well,, as i dont have fixed index,, i need to search all indexes that are having field url with ip address,, so i want to apply search first instead of extracting ips. 

raw url formats are =http://1.1.1.1/, 1.1.1.1:443, http://1.1.1.1/xyc.co
 i tried so far 

(index=*)  |fields url |where match )url, "^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\")

it is working but only showing url as 1.1.1.1:443, not rest formats. 
any idea what can i do?

note: i dont want to write regex to extract IPs in new field first and than apply search (new field=*), it will work but query will take time as first it will search for all the urls,, then apply regex and then will apply filter.

Labels (2)
Tags (3)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You are anchoring the start of the string to match with ^

Try this example, where the regex matches an optional https at the start of the string

| makeresults
| eval url=split("http://1.1.1.1/,1.1.1.1:443,http://1.1.1.1/xyc.co,https://1.254.21.2221?q=abc,9.9.9.9.443", ",")
| mvexpand url
| where match(url, "(https?)?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}")
0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

REGISTER NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more ...

Security Highlights | November 2022 Newsletter

 November 2022 2022 Gartner Magic Quadrant for SIEM: Splunk Named a Leader for the 9th Year in a RowSplunk is ...

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...