Hi All,
I'm currently in trying to extract the second IP address in each log as an field, but I'm simply not able to achive the desired results. The log differ quite variably and I'm unable to get a reliable pattern to "use" only the second match on IP address
REGEX query to grab match IP address
(?P<Public_IP_Test>\d+\.\d+\.\d+\.\d+)
Log Example
2020-10-19 14:13:54 12.23.34.45 POST /owa/service.svc action=FindItem&UA=0&ID=-18&AD=1&CorrelationID=e275e3c1-7ccb-4ac9-95a3-58550573648f_160312683455318;&ClientId=***************; 443 testing@domain.com 34.56.78.89 Mozilla/5.0+(iPhone;+CPU+iPhone+OS+13_3_1+like+Mac+OS+X)+AppleWebKit/605.1.15+(KHTML,+like+Gecko)+Version/13.0.5+Mobile/15E148+Safari/604.1 https://mail.domain.com/owa/ 200 0 0 124
Any assistance will be greatly appreciated
Hi @Pmeiring ..this rex works fine.. (thanks to @Ayn for the rex)
| makeresults
| eval log="2020-10-19 14:13:54 12.23.34.45 POST testing@domain.com 34.56.78.89"
| rex field=log "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}.+?(?<ip_addr>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| table ip_addr
Hi @Azeemering for my learning, i tried this rex, but, somehow its giving error only.. starting with "^".. should i escape it or please format the rex query. thanks..
Try this in your search bar:
index=yourindex sourcetype=yoursourcetype | rex "^(?:[^ \n]* ){8}(?P<Public_IP_Test>[^ ]+)"
This works fine for me and extracts the second ip as the specified field
Hi @Pmeiring ..this rex works fine.. (thanks to @Ayn for the rex)
| makeresults
| eval log="2020-10-19 14:13:54 12.23.34.45 POST testing@domain.com 34.56.78.89"
| rex field=log "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}.+?(?<ip_addr>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| table ip_addr
Worked like a charm, irrespective of the log format
Thanks @inventsekar
Try this: ^(?:[^ \n]* ){8}(?P<Public_IP_Test>[^ ]+)
Is this what you need?