Splunk Search

Extract second instance of IP address

Pmeiring
Explorer

Hi All, 

I'm currently in trying to extract the second IP address in each log as an field, but I'm simply not able to achive the desired results. The log differ quite variably and I'm unable to get a reliable pattern to "use" only the second match on IP address 

REGEX query to grab match IP address

(?P<Public_IP_Test>\d+\.\d+\.\d+\.\d+)

Log Example 

2020-10-19 14:13:54 12.23.34.45 POST /owa/service.svc action=FindItem&UA=0&ID=-18&AD=1&CorrelationID=e275e3c1-7ccb-4ac9-95a3-58550573648f_160312683455318;&ClientId=***************; 443 testing@domain.com 34.56.78.89 Mozilla/5.0+(iPhone;+CPU+iPhone+OS+13_3_1+like+Mac+OS+X)+AppleWebKit/605.1.15+(KHTML,+like+Gecko)+Version/13.0.5+Mobile/15E148+Safari/604.1 https://mail.domain.com/owa/ 200 0 0 124

 

Any assistance will be greatly appreciated 

Labels (2)
1 Solution

inventsekar
SplunkTrust
SplunkTrust

Hi @Pmeiring ..this rex works fine.. (thanks to @Ayn for the rex) 

| makeresults 
| eval log="2020-10-19 14:13:54 12.23.34.45 POST testing@domain.com 34.56.78.89" 
| rex field=log "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}.+?(?<ip_addr>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" 
| table ip_addr

 rex-ip.jpg

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

View solution in original post

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @Azeemering for my learning, i tried this rex, but, somehow its giving error only.. starting with "^".. should i escape it or please format the rex query. thanks..

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

Azeemering
Builder

Try this in your search bar:

index=yourindex sourcetype=yoursourcetype | rex "^(?:[^ \n]* ){8}(?P<Public_IP_Test>[^ ]+)"

This works fine for me and extracts the second ip as the specified field

inventsekar
SplunkTrust
SplunkTrust

Hi @Pmeiring ..this rex works fine.. (thanks to @Ayn for the rex) 

| makeresults 
| eval log="2020-10-19 14:13:54 12.23.34.45 POST testing@domain.com 34.56.78.89" 
| rex field=log "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}.+?(?<ip_addr>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" 
| table ip_addr

 rex-ip.jpg

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

Pmeiring
Explorer

Worked like a charm, irrespective of the log format 

Thanks @inventsekar 

Azeemering
Builder

Try this:  ^(?:[^ \n]* ){8}(?P<Public_IP_Test>[^ ]+)

Is this what you need?

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...