Have to remove the last section of IP addresses before getting a stats count for each one?

[ewanbrown]

Hi,

I have a list of IPs, and I want to create a chart showing traffic from them, but I also want a version which excludes the last section. As IPs can be varying lengths, I'm not sure how to do this. I think I need to find the 3rd, and then remove the data after that.

e.g. if I had 3 events

1.2.3.4
1.2.3.5
123.456.567.345

I'd want to show a table like this:

1.2.3 = 2
123.456.567 = 1

Thanks

[dshpritz · Accepted solution]

You can do this pretty easily by adding a new field extraction. An example would be:

In props.conf:

[mysourcetype]
EXTRACT-ip_start = ^(?<ip_start>\d{1,3}\.\d{1,3}\.\d{1,3})\.\d{1,3} IN myfield

In this case, mysourcetype would be the name of the sourcetype you need this field added to, and then "myfield" would be the name of the existing field that contains the IP address. Note that you may need to adjust the extraction to make sure that the field you are extracting this from exists prior to the extraction above (see here for parsing order at search time).

Alternatively, you can use the rex command and do something like this:

sourcetype=mysourcetype | rex field=myfield ^(?<ip_start>\d{1,3}\.\d{1,3}\.\d{1,3})\.\d{1,3} | stats count by ip_start

HTH,

Dave

Edit: Added a more exact regex. Thanks IRC!

[ewanbrown]

Thanks, that's perfect