Splunk Search

Field Extraction (rex maybe?)

a_n
Path Finder

Hello All,

I am not good in Regular Expressions, I need you assist.

In my data, I have a field containing IPs and Ports but in specific sequence:

...some text ... SourceIP DestIP SrcPort DestPort ....some text...
between them there is one SPACE.
as an example:
message=...w 2-APIS 0-External-1 tcp 10.0.12.13 40.126.31.8 55373 443 msg=\"HTTS...

I need to extract fields for SrcIP, DestIP, SrcPort and DestPort.
when I use

 \b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b \b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b \d* \d*

OR

\b(?:[0-9]{1,3}\.){3}[0-9]{1,3} (?:[0-9]{1,3}\.){3}[0-9]{1,3}\b \d* \d*
I can grab the 2 IPs and ports  with spaces between them.
I am confused about how to assign each to a new field.
Can someone help?
Or do I have to use REX for search time extraction?
Even to use REX, I appreciate your advices.

Regards,

-Ali

Labels (2)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @a_n,

You should use captured group on regex. 

rex sample;

| rex field=message "\b(?<src_ip>(?:[0-9]{1,3}\.){3}[0-9]{1,3})\b \b(?<dest_ip>(?:[0-9]{1,3}\.){3}[0-9]{1,3})\b (?<src_port>\d*) (?<dest_port>\d*)"

props.conf extract

EXTRACT-fields = \b(?<src_ip>(?:[0-9]{1,3}\.){3}[0-9]{1,3})\b \b(?<dest_ip>(?:[0-9]{1,3}\.){3}[0-9]{1,3})\b (?<src_port>\d*) (?<dest_port>\d*)
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

a_n
Path Finder

Thank you @scelikok 

Undersood.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @a_n,

please try this:

| rex "(?<src_ip>\d+\.\d+\.\d+\.\d+)\s+(?<dest_ip>\d+\.\d+\.\d+\.\d+)\s+(?<src_port>\d+)\s+(?<dest_port>\d+)"

that you can test at https://regex101.com/r/UTRazw/1

if you could share two or three full samples of your logs I could be more precise.

Ciao.

Giuseppe

a_n
Path Finder

@gcusello 

Thank you

0 Karma

a_n
Path Finder

Dears,
I used this:
(?<srcip>\d+\.\d+\.\d+\.\d+) (?<dstip>\d+\.\d+\.\d+\.\d+) (?<srcpt>\d+) (?<dstpt>\d+)

Seems ok, but does anyone have better idea?

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @a_n,

You should use captured group on regex. 

rex sample;

| rex field=message "\b(?<src_ip>(?:[0-9]{1,3}\.){3}[0-9]{1,3})\b \b(?<dest_ip>(?:[0-9]{1,3}\.){3}[0-9]{1,3})\b (?<src_port>\d*) (?<dest_port>\d*)"

props.conf extract

EXTRACT-fields = \b(?<src_ip>(?:[0-9]{1,3}\.){3}[0-9]{1,3})\b \b(?<dest_ip>(?:[0-9]{1,3}\.){3}[0-9]{1,3})\b (?<src_port>\d*) (?<dest_port>\d*)
If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...