Splunk Search

How do I extract IP and port using regex in Splunk Cloud?

harishnpandey
Explorer

Hi ,

May I please get some help on extracting

1) IP only
2) IP and corresponding port together

Connection terminated before request headers read because of the connection error that occurs, from URL: 10.197.64.27:50421

Appreciate your help on this in advance

Thanks & regards,
Harish

Tags (2)
0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi @harishpandey,

Please try below query, below regex will extract IP and Port in different fields.

<yourBaseSearch> | rex field=_raw "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\:(?<port>\d+)"

If you want IP and port together try below query

<yourBaseSearch> | rex field=_raw "(?<ip_port>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d+)"

For IP address only

<yourBaseSearch> | rex field=_raw "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

View solution in original post

Vijeta
Influencer

Hi,

For IP and Port use this

 rex field=str "URL: (?<IP>\S+)"

For eg:
| makeresults| eval str="Connection terminated before request headers read because of the connection error occurs, from URL: 10.197.64.27:50421" | rex field=str "URL: (?\S+)"

For only IP

rex field=str "URL: (?<IP>\S+):\d+"
0 Karma

harsmarvania57
Ultra Champion

Hi @harishpandey,

Please try below query, below regex will extract IP and Port in different fields.

<yourBaseSearch> | rex field=_raw "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\:(?<port>\d+)"

If you want IP and port together try below query

<yourBaseSearch> | rex field=_raw "(?<ip_port>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d+)"

For IP address only

<yourBaseSearch> | rex field=_raw "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

harishnpandey
Explorer

Thanks for your reply @harsmarvania57

However, I was trying with keyword URL: while extracting IP field so that I can limit my IP search that starts with URL: and ignore all other IP's

index=datapower | rex field=_raw URL:"(?\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})"| stats count by ip|sort -count aesc

But, above one did not work 😞

0 Karma

harsmarvania57
Ultra Champion

Try this

index=datapower | rex field=_raw "URL\:\s(?<ip>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})"| stats count by ip|sort -count
0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...