Splunk Search

Extraction of Multiple events (URLS and IP addresses) from text files

capilarity
Path Finder

Hi,

We receive daily emails with lists of IOC's for malware and phishing alerts, each email may contain multiple ip address, domains and email addresses and we are trying to extract these to run searches against out web and email logs. 

I have the regex working for extraction but it will only extract the first match.

I've tried multiple ways of achieving this without success, the current config is:

Props.conf

EXTRACT-IOCURL = (?P<IOCURL>[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9][\[][\.|@][\]][^\s]{2,}|[a-zA-Z0-9][a-zA-Z0-9-]+[a-zA-Z0-9][\[][\.|@][\]][^\s]{2,}|[a-zA-Z0-9]+[\[][\.|@][\]][^\s]{2,}|[a-zA-Z0-9]+[\[][\.|@][\]][^\s]{2,})

EXTRACT-IOCIP = (?P<IOCIP>\d{1,3}\[\.\]\d{1,3}\[\.\]\d{1,3}\[\.\]\d{1,3}+)


The indexed email looks like this....

....

Domains
comprised[.]site
badsite[.]studio
malware[.]live

IP addresses
192[.]254[.]71[.]78
192[.]71[.]27[.]202
193[.]182[.]144[.]67 

....

 

but the current config will only extract the first record for each:

IOCURL - comprised[.]site

and 

IOCIP  - 192[.]254[.]71[.]78.

Any ideas how to extract all the domains and IP addresses?

Thanks 

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

one way is move this to transforms.conf and use MV_ADD = 1 like in e.g. this https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-field-that-appears-several-times-but-...

r. Ismo

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...