Something like that:
([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\/*\d*).+
Adding context for anyone coming here for answers.
Assuming msg is the field name, the following would result in the first IP found
| makeresults
| eval msg = "192.128.22.2 202.134.55.89"
| rex field=msg "(?<firstip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
If additional IPs needed to be extracted then a max_match = # could be added to the rex line.
Something like that:
([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\/*\d*).+
worked by removing .+ at the end ...
not working .. i tried here
https://regex101.com/r/2MblRX/1