Splunk Search

How do you use the rex command to parse out the IP between fix characters?

New Member

Hi all,

I was wondering how can i write a Splunk rex to parse out the IP between two words.

for example

  <IpAddress>8.8.8.8, 2.2.2.2</IpAddress>
  <blahblah>1.1.1.1, 2.2.2.2, x.x.x.x</blahblah>

I am able to write a search

but in results it parses out "8.8.8.8<" and "x.x.x.x<"

I only care about the first IP address between.

I'm looking forward to hearing from you guys.

0 Karma
1 Solution

Champion

Hi @AbubakarShahid

Try this it will extract first ip address

| makeresults 
| eval str="<blahblah>1.1.1.1, 2.2.2.2, x.x.x.x</blahblah>" 
| rex field=str ">(?P<ipaddress>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})"

View solution in original post

0 Karma

Champion

Hi @AbubakarShahid

Try this it will extract first ip address

| makeresults 
| eval str="<blahblah>1.1.1.1, 2.2.2.2, x.x.x.x</blahblah>" 
| rex field=str ">(?P<ipaddress>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})"

View solution in original post

0 Karma

Ultra Champion

Your question is a bit unclear (partly because I think some stuff between <> went missing?). Can you please clarify a bit what it is exactly that you want to extract? And please also share the search you have so far.

Taking my best guess at what you want, wouldn't this do the trick:

| rex "\<IpAddress\>(?<IP>\d+\.\d+\.\d+\.\d+)"

https://regex101.com/r/JWEbRc/1

0 Karma