Splunk Search

How do I extract a field from my data in a search?

Communicator

I want to extract the ip address as field ipaddress in a search.

04-15-2016 05:34:01.228 -0400 ERROR HttpClientRequest - HTTP client error: Connection reset by peer (while accessing http://xx.xx.xx.xx:8089/services/server/info)

Can some one please help?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi,

Is this what you are trying to achieve?
(You can ignore the first two lines, they are just for me to be able to test this)

| stats count
| fields - count
| eval _raw = "04-15-2016 05:34:01.228 -0400 ERROR HttpClientRequest - HTTP client error: Connection reset by peer (while accessing http://123.45.67.89:8089/services/server/info)";
| rex "(?<ipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

Another valid regex could be:

| rex "(?i)http://(?<ipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

Or:

| rex "(?i)http://(?<ipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}):"

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Hi,

Is this what you are trying to achieve?
(You can ignore the first two lines, they are just for me to be able to test this)

| stats count
| fields - count
| eval _raw = "04-15-2016 05:34:01.228 -0400 ERROR HttpClientRequest - HTTP client error: Connection reset by peer (while accessing http://123.45.67.89:8089/services/server/info)";
| rex "(?<ipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

Another valid regex could be:

| rex "(?i)http://(?<ipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

Or:

| rex "(?i)http://(?<ipaddress>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}):"

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!