How do I extract IP and port using regex in Splunk Cloud?

[harishnpandey]

Hi ,

May I please get some help on extracting

1) IP only
2) IP and corresponding port together

Connection terminated before request headers read because of the connection error that occurs, from URL: 10.197.64.27:50421

Appreciate your help on this in advance

Thanks & regards,
Harish

[Vijeta]

Hi,

For IP and Port use this

 rex field=str "URL: (?<IP>\S+)"

For eg:
| makeresults| eval str="Connection terminated before request headers read because of the connection error occurs, from URL: 10.197.64.27:50421" | rex field=str "URL: (?\S+)"

For only IP

rex field=str "URL: (?<IP>\S+):\d+"

[harsmarvania57 · Accepted solution]

Hi @harishpandey,

Please try below query, below regex will extract IP and Port in different fields.

<yourBaseSearch> | rex field=_raw "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\:(?<port>\d+)"

If you want IP and port together try below query

<yourBaseSearch> | rex field=_raw "(?<ip_port>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d+)"

For IP address only

<yourBaseSearch> | rex field=_raw "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

[harishnpandey]

Thanks for your reply @harsmarvania57

However, I was trying with keyword URL: while extracting IP field so that I can limit my IP search that starts with URL: and ignore all other IP's

index=datapower | rex field=_raw URL:"(?\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})"| stats count by ip|sort -count aesc

But, above one did not work 😞

[harsmarvania57]

Try this

index=datapower | rex field=_raw "URL\:\s(?<ip>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})"| stats count by ip|sort -count