Re: Extract IP from TCPDUMP

DTERM · ‎10-10-2012

How can I extract the source IP from the following log format?

16:13:40.860435 IP 192.54.112.34.domain > 61.220.8.179.61415: 32341- 0/5/6 (207)

All I'm interested in is the 192.54.112.34 IP address?

Thanks....

Ayn · ‎10-10-2012

Umm, use the Interactive Field Extractor? I would write in more detail on creating your own regex, but seeing as I recall you asking the same kind of question before it seems you would benefit from using the IFX.

DTERM · ‎10-11-2012

The IFX does not show the 192.54.112.34.domain or the 61.220.8.179.61415: 32341 fields. Why is that?

Extract IP from TCPDUMP

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Join the Hackathon at .conf26 and build a No-Code AI agent

Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform

Forwarder Topology Guidance: Intermediate HF vs Intermediate UF

Join the Conversation