Splunk Search

How do I extract IP and port using regex in Splunk Cloud?

harishnpandey
Explorer

Hi ,

May I please get some help on extracting

1) IP only
2) IP and corresponding port together

Connection terminated before request headers read because of the connection error that occurs, from URL: 10.197.64.27:50421

Appreciate your help on this in advance

Thanks & regards,
Harish

Tags (2)
0 Karma
1 Solution

harsmarvania57
SplunkTrust
SplunkTrust

Hi @harishpandey,

Please try below query, below regex will extract IP and Port in different fields.

<yourBaseSearch> | rex field=_raw "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\:(?<port>\d+)"

If you want IP and port together try below query

<yourBaseSearch> | rex field=_raw "(?<ip_port>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d+)"

For IP address only

<yourBaseSearch> | rex field=_raw "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

View solution in original post

Vijeta
Influencer

Hi,

For IP and Port use this

 rex field=str "URL: (?<IP>\S+)"

For eg:
| makeresults| eval str="Connection terminated before request headers read because of the connection error occurs, from URL: 10.197.64.27:50421" | rex field=str "URL: (?\S+)"

For only IP

rex field=str "URL: (?<IP>\S+):\d+"
0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Hi @harishpandey,

Please try below query, below regex will extract IP and Port in different fields.

<yourBaseSearch> | rex field=_raw "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\:(?<port>\d+)"

If you want IP and port together try below query

<yourBaseSearch> | rex field=_raw "(?<ip_port>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d+)"

For IP address only

<yourBaseSearch> | rex field=_raw "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

View solution in original post

harishnpandey
Explorer

Thanks for your reply @harsmarvania57

However, I was trying with keyword URL: while extracting IP field so that I can limit my IP search that starts with URL: and ignore all other IP's

index=datapower | rex field=_raw URL:"(?\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})"| stats count by ip|sort -count aesc

But, above one did not work 😞

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Try this

index=datapower | rex field=_raw "URL\:\s(?<ip>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})"| stats count by ip|sort -count
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!