Splunk Search

How do I extract IP and port using regex in Splunk Cloud?

harishnpandey
Explorer

Hi ,

May I please get some help on extracting

1) IP only
2) IP and corresponding port together

Connection terminated before request headers read because of the connection error that occurs, from URL: 10.197.64.27:50421

Appreciate your help on this in advance

Thanks & regards,
Harish

Tags (2)
0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi @harishpandey,

Please try below query, below regex will extract IP and Port in different fields.

<yourBaseSearch> | rex field=_raw "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\:(?<port>\d+)"

If you want IP and port together try below query

<yourBaseSearch> | rex field=_raw "(?<ip_port>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d+)"

For IP address only

<yourBaseSearch> | rex field=_raw "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

View solution in original post

Vijeta
Influencer

Hi,

For IP and Port use this

 rex field=str "URL: (?<IP>\S+)"

For eg:
| makeresults| eval str="Connection terminated before request headers read because of the connection error occurs, from URL: 10.197.64.27:50421" | rex field=str "URL: (?\S+)"

For only IP

rex field=str "URL: (?<IP>\S+):\d+"
0 Karma

harsmarvania57
Ultra Champion

Hi @harishpandey,

Please try below query, below regex will extract IP and Port in different fields.

<yourBaseSearch> | rex field=_raw "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\:(?<port>\d+)"

If you want IP and port together try below query

<yourBaseSearch> | rex field=_raw "(?<ip_port>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d+)"

For IP address only

<yourBaseSearch> | rex field=_raw "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

harishnpandey
Explorer

Thanks for your reply @harsmarvania57

However, I was trying with keyword URL: while extracting IP field so that I can limit my IP search that starts with URL: and ignore all other IP's

index=datapower | rex field=_raw URL:"(?\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})"| stats count by ip|sort -count aesc

But, above one did not work 😞

0 Karma

harsmarvania57
Ultra Champion

Try this

index=datapower | rex field=_raw "URL\:\s(?<ip>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})"| stats count by ip|sort -count
0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...