Splunk Search

Extract ip address from result

nsiva
New Member

my output in splunk is as below 

<error code #> IP Address is x.y.z.a 

 

I want to extract only the x.y.z.a and its count. Should ignore duplicates.

 

Can someone please assist?

Labels (1)
0 Karma

nyc_jason
Splunk Employee
Splunk Employee
0 Karma

nsiva
New Member

I did look at that but couldn’t comprehend it to my need. Hence, posted this. 

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @nsiva Please try this:

| makeresults | eval _raw = "123 IP Address is 1.2.3.4"
| rex field=_raw "is\s(?P<ip>.*)" | table _raw ip

once if the rex is working fine, then you can do,
"|stats count by ip"

 

let us know what happens, thanks. 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

nsiva
New Member

@inventsekar This works only for the ip address 1.2.3.4. What do I do if the ip address changes to 5.6.7.8 or 4.3.2.1? 

0 Karma

inventsekar
SplunkTrust
SplunkTrust
#your base search which produce the logs, ... like index=abc sourcetype=abc

index=firewall sourcetype=abc
| rex field=_raw "is\s(?P<ip>.*)" 
| table _raw ip
| stats count by ip

Hi @nsiva .. 

if this search does not work, pls show us a screenshot.. thanks. 

 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

tej57
Contributor

Hey @nsiva ,

The query that @inventsekar has posted will work with any of the ip address provided the raw event is 

123 IP Address is 1.2.3.4

 Can you please elaborate why the solution doesn't work for you? 

And for your reference, I've used 4.3.2.1 in _raw and it still extracts the ip address. Find the below screenshot.

tej57_0-1715344085679.png

 

To assist you better, it would be great if you can provide the raw events and then ip field can be extracted from the same. You can redact the sensitive information.

 

Thanks,
Tejas.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...