How do you use the rex command to parse out the IP between fix characters?

[AbubakarShahid]

Hi all,

I was wondering how can i write a Splunk rex to parse out the IP between two words.

for example

  <IpAddress>8.8.8.8, 2.2.2.2</IpAddress>
  <blahblah>1.1.1.1, 2.2.2.2, x.x.x.x</blahblah>

I am able to write a search

but in results it parses out "8.8.8.8<" and "x.x.x.x<"

I only care about the first IP address between.

I'm looking forward to hearing from you guys.

[vnravikumar · Accepted solution]

Hi @AbubakarShahid

Try this it will extract first ip address

| makeresults 
| eval str="<blahblah>1.1.1.1, 2.2.2.2, x.x.x.x</blahblah>" 
| rex field=str ">(?P<ipaddress>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})"

[FrankVl]

Your question is a bit unclear (partly because I think some stuff between <> went missing?). Can you please clarify a bit what it is exactly that you want to extract? And please also share the search you have so far.

Taking my best guess at what you want, wouldn't this do the trick:

| rex "\<IpAddress\>(?<IP>\d+\.\d+\.\d+\.\d+)"

https://regex101.com/r/JWEbRc/1