Splunk Search

How to exract regex to my field

splunkn
Communicator

I am having events like below,

E.g. 1 Nov 7 10:18:49 111.222.333.444 Success user=abc userid=123 account=xyz
E.g.2 Nov 7 10:18:49 Success user=sdf userid=234 account=asdf destip=111.222.333.444

In some events (E.g. 1 ) we are having Destintation IP after the timestamp
But in some events (E.g. 2) we are having DestinationIP in a separate field named destip

How to write a regex for this to extract a single field as DestIP?
Could anyone help me with this?

Tags (2)
0 Karma
1 Solution

gfuente
Motivator

Hello

Supposing that you only have one ip in each event you could extract it with this regex, no matter where it is located:

(?<destip>\d+\.\d+\.\d+\.\d+)

Regards

View solution in original post

0 Karma

gfuente
Motivator

Hello

Supposing that you only have one ip in each event you could extract it with this regex, no matter where it is located:

(?<destip>\d+\.\d+\.\d+\.\d+)

Regards

0 Karma

gfuente
Motivator

Ok, then use this one:

(\d\d\:\d\d\:\d\d\s|destip\=)(?<destip>\d+\.\d+\.\d+\.\d+)
0 Karma

splunkn
Communicator

Many thanks :slightly_smiling_face:

0 Karma

splunkn
Communicator

Sad part is my events are having more than one IPs in event like sourceip,thirdpartyip :disappointed_face:

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...