Splunk Search

Could someone provide regex help?

tkerr1357
Path Finder

Hey all , 

just need a little regex help trying to pull an IP address out  and its not working.

here is my rex 

| rex field=_raw "Remote host:(?<Remotehost>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

here is an example event 

4/7/22
3:11:32.000 PM
 
04/07/2022 03:11:32 PM LogName=Security EventCode=4779 EventType=0 ComputerName=BPSQCP00S080.rightnetworks.com SourceName=Microsoft Windows security auditing. Type=Information RecordNumber=115076290 Keywords=Audit Success TaskCategory=Other Logon/Logoff Events OpCode=Info Message=A session was disconnected from a Window Station. Subject: Account Name: 705628 Account Domain: RIGHTNETWORKS Logon ID: 0x13887BFB Session: Session Name: RDP-Tcp#81 Additional Information: Client Name: DESKTOP-PIT40LB Client Address: 73.175.205.64
Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Your event doesn't have "Remote host:" in it

0 Karma

tkerr1357
Path Finder

sorry sent the wrong rex 

| rex "Client Address:(?<clientaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Your event has a space after the colon which isn't in your rex expression.

https://regex101.com/r/EeHQwE/1 

0 Karma

mayurr98
Super Champion

best to use "\s*" instead of "\s" if you are not sure if there will be a space is future events or not.

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...