How do I extract a field from my data in a search?

[sim_tcr]

I want to extract the ip address as field ipaddress in a search.

04-15-2016 05:34:01.228 -0400 ERROR HttpClientRequest - HTTP client error: Connection reset by peer (while accessing http://xx.xx.xx.xx:8089/services/server/info)

Can some one please help?

[javiergn · Accepted solution]

Hi,

Is this what you are trying to achieve?
(You can ignore the first two lines, they are just for me to be able to test this)

| stats count
| fields - count
| eval _raw = "04-15-2016 05:34:01.228 -0400 ERROR HttpClientRequest - HTTP client error: Connection reset by peer (while accessing http://123.45.67.89:8089/services/server/info)";
| rex "(?<ipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

Another valid regex could be:

| rex "(?i)http://(?<ipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

Or:

| rex "(?i)http://(?<ipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}):"