Extract second instance of IP address

[Pmeiring]

Hi All, 

I'm currently in trying to extract the second IP address in each log as an field, but I'm simply not able to achive the desired results. The log differ quite variably and I'm unable to get a reliable pattern to "use" only the second match on IP address 

REGEX query to grab match IP address

(?P<Public_IP_Test>\d+\.\d+\.\d+\.\d+)

Log Example 

2020-10-19 14:13:54 12.23.34.45 POST /owa/service.svc action=FindItem&UA=0&ID=-18&AD=1&CorrelationID=e275e3c1-7ccb-4ac9-95a3-58550573648f_160312683455318;&ClientId=***************; 443 [email protected] 34.56.78.89 Mozilla/5.0+(iPhone;+CPU+iPhone+OS+13_3_1+like+Mac+OS+X)+AppleWebKit/605.1.15+(KHTML,+like+Gecko)+Version/13.0.5+Mobile/15E148+Safari/604.1 https://mail.domain.com/owa/ 200 0 0 124

Any assistance will be greatly appreciated 

[inventsekar]

Hi @Azeemering for my learning, i tried this rex, but, somehow its giving error only.. starting with "^".. should i escape it or please format the rex query. thanks..

[Azeemering]

Try this in your search bar:

index=yourindex sourcetype=yoursourcetype | rex "^(?:[^ \n]* ){8}(?P<Public_IP_Test>[^ ]+)"

This works fine for me and extracts the second ip as the specified field

[inventsekar · Accepted solution]

Hi @Pmeiring ..this rex works fine.. (thanks to @Ayn for the rex) 

| makeresults 
| eval log="2020-10-19 14:13:54 12.23.34.45 POST [email protected] 34.56.78.89" 
| rex field=log "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}.+?(?<ip_addr>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" 
| table ip_addr

 

[Pmeiring]

Worked like a charm, irrespective of the log format 

Thanks @inventsekar 

[Azeemering]

Try this:  ^(?:[^ \n]* ){8}(?P<Public_IP_Test>[^ ]+)

Is this what you need?