Splunk Search

Extract IP address and user name for log

tevgey23
Explorer

Im trying to extract the IP address in the [] and the user name which follows it.
I tried a few different regex with no success.,

Any recommendations ?

May 16 15:39:57 192.x.x.x Juniper: 2013-05-16 16:39:58 - ive - [24.x.x.x] bob_b(Company - OTP)[VIT Users] - Key Exchange number 1 occured for user with NCIP 192.x.x.x

Tags (3)
0 Karma

kml_uvce
Builder

try this

your search|rex field=_raw "(?i)[(?P[^]]+)"|rex field=_raw "(?i)^[^]]*]\s+(?P[^(]+)"

you can also combine these 2 fields in one rex.

0 Karma

kristian_kolb
Ultra Champion

Put this in your props.conf to get it all in one go. Assumes that the ip-address is inside the first set of square brackets in each event, and the username follows immediately after that (well, with a whitespace in between actually). The username can only contain A-Z, a-z, 0-9, - and _

[your sourcetype]
EXTRACT-get_stuff = ^[\[]+\[(?<ip_adress>[\]]+)\]\s+(?<user_name>[-\w]+)

/k

0 Karma

kml_uvce
Builder

Try these field extraction:

(?i) ive \- \[(?P<IP_Address>[^\]]+)
(?i) OTP\)\[(?P<User_Name>[^\]]+) when user is VIT Users

(?i)^[^\]]*\]\s+(?P<User_name>[^\(]+) when user is bob_b
0 Karma

tevgey23
Explorer

Thank you for the reply. Seems to come up with an error

...| regex "(?i) ive - [(?P[^]]+)"

"Error in 'SearchOperator:regex': Usage: regex "(=|!=)

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...