Splunk Search

How to edit my rex search to extract two different or duplicate IP addresses at the same time?

Explorer

Current search:

search "xxx" | rex field=_raw "api:(?\s\d+.\d+.\d+.\d+)"

I'm using the rex command, but it does not return the expected result when there are two IP addresses.

0 Karma
1 Solution

Legend

If both IPs are in the same event with "api" before it, you can use max_match, like this

search "xxx" | rex max_match=0 field=_raw "api:\s?(?<IP>\d+.\d+.\d+.\d+)" | mvexpand IP | table IP

If they are not in the same event, will need to see some sample events.

http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Regex

View solution in original post

Legend

If both IPs are in the same event with "api" before it, you can use max_match, like this

search "xxx" | rex max_match=0 field=_raw "api:\s?(?<IP>\d+.\d+.\d+.\d+)" | mvexpand IP | table IP

If they are not in the same event, will need to see some sample events.

http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Regex

View solution in original post

SplunkTrust
SplunkTrust

Please share some sample events.

---
If this reply helps you, an upvote would be appreciated.
0 Karma