Splunk Search

Extract ip address from result

nsiva
New Member

my output in splunk is as below 

<error code #> IP Address is x.y.z.a 

 

I want to extract only the x.y.z.a and its count. Should ignore duplicates.

 

Can someone please assist?

Labels (1)
0 Karma

nyc_jason
Splunk Employee
Splunk Employee
0 Karma

nsiva
New Member

I did look at that but couldn’t comprehend it to my need. Hence, posted this. 

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @nsiva Please try this:

| makeresults | eval _raw = "123 IP Address is 1.2.3.4"
| rex field=_raw "is\s(?P<ip>.*)" | table _raw ip

once if the rex is working fine, then you can do,
"|stats count by ip"

 

let us know what happens, thanks. 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

nsiva
New Member

@inventsekar This works only for the ip address 1.2.3.4. What do I do if the ip address changes to 5.6.7.8 or 4.3.2.1? 

0 Karma

inventsekar
SplunkTrust
SplunkTrust
#your base search which produce the logs, ... like index=abc sourcetype=abc

index=firewall sourcetype=abc
| rex field=_raw "is\s(?P<ip>.*)" 
| table _raw ip
| stats count by ip

Hi @nsiva .. 

if this search does not work, pls show us a screenshot.. thanks. 

 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

tej57
Contributor

Hey @nsiva ,

The query that @inventsekar has posted will work with any of the ip address provided the raw event is 

123 IP Address is 1.2.3.4

 Can you please elaborate why the solution doesn't work for you? 

And for your reference, I've used 4.3.2.1 in _raw and it still extracts the ip address. Find the below screenshot.

tej57_0-1715344085679.png

 

To assist you better, it would be great if you can provide the raw events and then ip field can be extracted from the same. You can redact the sensitive information.

 

Thanks,
Tejas.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...