Splunk Search

How do I write the regex to identify the sourceip that can be found in different locations in my logs?

splunkn
Communicator

I have logs like below

1.1.1.1 This is my sourceip
2.2.2.2 My source ip is 1.1.1.2

I have a situation where in some events, my sourceip comes first in the line (AS in First EVENT), and other events, IPs come first, but this is not sourceip. Whatever comes after (in this case, 1.1.1.2) is my source ip. How to write a regex for this lookahead?

Thanks

Tags (2)
0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust

Try this:

| rex field=_raw max_match=0 "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| eval sourceIP = mvindex(ip, mvcount(ip)-1)

This is basically going to do the following:
- Store all the IPs in your event in the ip multivalued field (even if there's only one match, it will be a multivalued field with one value only)
- Retrieve the latest ip from the multivalued field and assign to sourceIP

Example:

| stats count | fields - count
| eval raw = "1.1.1.1 This is my sourceip; 2.2.2.2 My source ip is 1.1.1.2"
| eval raw = split(raw, ";")
| mvexpand raw
| rex field=raw max_match=0 "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| eval sourceIP = mvindex(ip, mvcount(ip)-1)

Output: see attached picture
alt text

View solution in original post

0 Karma

javiergn
SplunkTrust
SplunkTrust

Try this:

| rex field=_raw max_match=0 "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| eval sourceIP = mvindex(ip, mvcount(ip)-1)

This is basically going to do the following:
- Store all the IPs in your event in the ip multivalued field (even if there's only one match, it will be a multivalued field with one value only)
- Retrieve the latest ip from the multivalued field and assign to sourceIP

Example:

| stats count | fields - count
| eval raw = "1.1.1.1 This is my sourceip; 2.2.2.2 My source ip is 1.1.1.2"
| eval raw = split(raw, ";")
| mvexpand raw
| rex field=raw max_match=0 "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| eval sourceIP = mvindex(ip, mvcount(ip)-1)

Output: see attached picture
alt text

0 Karma

tgdvopab
Path Finder

You can use two different regex:
for the first event: rex field=yourfield "^(?P(\d.){4})This is my sourceip"
for the 2nd even: rex field=youfield ".*My source ip is\s(?P(\d.){3}\d)"

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...