Splunk Search

Field Extraction (rex maybe?)

a_n
Path Finder

Hello All,

I am not good in Regular Expressions, I need you assist.

In my data, I have a field containing IPs and Ports but in specific sequence:

...some text ... SourceIP DestIP SrcPort DestPort ....some text...
between them there is one SPACE.
as an example:
message=...w 2-APIS 0-External-1 tcp 10.0.12.13 40.126.31.8 55373 443 msg=\"HTTS...

I need to extract fields for SrcIP, DestIP, SrcPort and DestPort.
when I use

 \b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b \b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b \d* \d*

OR

\b(?:[0-9]{1,3}\.){3}[0-9]{1,3} (?:[0-9]{1,3}\.){3}[0-9]{1,3}\b \d* \d*
I can grab the 2 IPs and ports  with spaces between them.
I am confused about how to assign each to a new field.
Can someone help?
Or do I have to use REX for search time extraction?
Even to use REX, I appreciate your advices.

Regards,

-Ali

Labels (2)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @a_n,

You should use captured group on regex. 

rex sample;

| rex field=message "\b(?<src_ip>(?:[0-9]{1,3}\.){3}[0-9]{1,3})\b \b(?<dest_ip>(?:[0-9]{1,3}\.){3}[0-9]{1,3})\b (?<src_port>\d*) (?<dest_port>\d*)"

props.conf extract

EXTRACT-fields = \b(?<src_ip>(?:[0-9]{1,3}\.){3}[0-9]{1,3})\b \b(?<dest_ip>(?:[0-9]{1,3}\.){3}[0-9]{1,3})\b (?<src_port>\d*) (?<dest_port>\d*)
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

a_n
Path Finder

Thank you @scelikok 

Undersood.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @a_n,

please try this:

| rex "(?<src_ip>\d+\.\d+\.\d+\.\d+)\s+(?<dest_ip>\d+\.\d+\.\d+\.\d+)\s+(?<src_port>\d+)\s+(?<dest_port>\d+)"

that you can test at https://regex101.com/r/UTRazw/1

if you could share two or three full samples of your logs I could be more precise.

Ciao.

Giuseppe

a_n
Path Finder

@gcusello 

Thank you

0 Karma

a_n
Path Finder

Dears,
I used this:
(?<srcip>\d+\.\d+\.\d+\.\d+) (?<dstip>\d+\.\d+\.\d+\.\d+) (?<srcpt>\d+) (?<dstpt>\d+)

Seems ok, but does anyone have better idea?

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @a_n,

You should use captured group on regex. 

rex sample;

| rex field=message "\b(?<src_ip>(?:[0-9]{1,3}\.){3}[0-9]{1,3})\b \b(?<dest_ip>(?:[0-9]{1,3}\.){3}[0-9]{1,3})\b (?<src_port>\d*) (?<dest_port>\d*)"

props.conf extract

EXTRACT-fields = \b(?<src_ip>(?:[0-9]{1,3}\.){3}[0-9]{1,3})\b \b(?<dest_ip>(?:[0-9]{1,3}\.){3}[0-9]{1,3})\b (?<src_port>\d*) (?<dest_port>\d*)
If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...