Splunk Search

Field Extraction (rex maybe?)

a_n
Path Finder

Hello All,

I am not good in Regular Expressions, I need you assist.

In my data, I have a field containing IPs and Ports but in specific sequence:

...some text ... SourceIP DestIP SrcPort DestPort ....some text...
between them there is one SPACE.
as an example:
message=...w 2-APIS 0-External-1 tcp 10.0.12.13 40.126.31.8 55373 443 msg=\"HTTS...

I need to extract fields for SrcIP, DestIP, SrcPort and DestPort.
when I use

 \b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b \b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b \d* \d*

OR

\b(?:[0-9]{1,3}\.){3}[0-9]{1,3} (?:[0-9]{1,3}\.){3}[0-9]{1,3}\b \d* \d*
I can grab the 2 IPs and ports  with spaces between them.
I am confused about how to assign each to a new field.
Can someone help?
Or do I have to use REX for search time extraction?
Even to use REX, I appreciate your advices.

Regards,

-Ali

Labels (2)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @a_n,

You should use captured group on regex. 

rex sample;

| rex field=message "\b(?<src_ip>(?:[0-9]{1,3}\.){3}[0-9]{1,3})\b \b(?<dest_ip>(?:[0-9]{1,3}\.){3}[0-9]{1,3})\b (?<src_port>\d*) (?<dest_port>\d*)"

props.conf extract

EXTRACT-fields = \b(?<src_ip>(?:[0-9]{1,3}\.){3}[0-9]{1,3})\b \b(?<dest_ip>(?:[0-9]{1,3}\.){3}[0-9]{1,3})\b (?<src_port>\d*) (?<dest_port>\d*)
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

a_n
Path Finder

Thank you @scelikok 

Undersood.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @a_n,

please try this:

| rex "(?<src_ip>\d+\.\d+\.\d+\.\d+)\s+(?<dest_ip>\d+\.\d+\.\d+\.\d+)\s+(?<src_port>\d+)\s+(?<dest_port>\d+)"

that you can test at https://regex101.com/r/UTRazw/1

if you could share two or three full samples of your logs I could be more precise.

Ciao.

Giuseppe

a_n
Path Finder

@gcusello 

Thank you

0 Karma

a_n
Path Finder

Dears,
I used this:
(?<srcip>\d+\.\d+\.\d+\.\d+) (?<dstip>\d+\.\d+\.\d+\.\d+) (?<srcpt>\d+) (?<dstpt>\d+)

Seems ok, but does anyone have better idea?

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @a_n,

You should use captured group on regex. 

rex sample;

| rex field=message "\b(?<src_ip>(?:[0-9]{1,3}\.){3}[0-9]{1,3})\b \b(?<dest_ip>(?:[0-9]{1,3}\.){3}[0-9]{1,3})\b (?<src_port>\d*) (?<dest_port>\d*)"

props.conf extract

EXTRACT-fields = \b(?<src_ip>(?:[0-9]{1,3}\.){3}[0-9]{1,3})\b \b(?<dest_ip>(?:[0-9]{1,3}\.){3}[0-9]{1,3})\b (?<src_port>\d*) (?<dest_port>\d*)
If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...