Splunk Search

How to create a regex to extract the first IP address from multiple IP addresses in an event line?

reverse
Contributor

There are multiple ip addresses in a raw event line and I only need the first one
How can I achieve that?

192.168.0.1 -192.168.0.5 gcgh 192.168.0.7gcgh 192.168.0.7 gcgh 192.168.0.8 gcgh 192.168.0.9 gcgh
Tags (2)
0 Karma
1 Solution

felipesewaybric
Contributor

Something like that:

([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\/*\d*).+

View solution in original post

0 Karma

jazzypai
Path Finder

Adding context for anyone coming here for answers.

Assuming msg is the field name, the following would result in the first IP found

| makeresults  
| eval msg = "192.128.22.2 202.134.55.89" 
| rex field=msg "(?<firstip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

If additional IPs needed to be extracted then a max_match = # could be added to the rex line.

felipesewaybric
Contributor

Something like that:

([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\/*\d*).+
0 Karma

reverse
Contributor

worked by removing .+ at the end ...

0 Karma

reverse
Contributor

not working .. i tried here
https://regex101.com/r/2MblRX/1

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...