Splunk Search

How to extract a field from my raw data using rex?

alexspunkshell
Contributor

In my splunk logs, i have 2 IPs in 1 field name.

I want to extract both IPs create a new field as IP1 & IP2. Please help here.

The user XYZ was involved in an impossible travel incident. The user connected from two countries within 280 minutes, from these IP addresses: United States (205.000.000.0) and Italy (37.000.000.00). If any of these IP addresses are used by the organization for VPN connections and do not necessarily represent a physical location, we recommend categorizing them as VPN in the IP Address range page in Microsoft Defender for Cloud Apps portal to avoid false alerts.

 

Example

IP1 - 205.000.000.0

IP2 - 37.000.000.00

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @alexspunkshell,

if you could share a sample of your logs I could be more detailed in my answer,

anyway, you have two choices:

  • if you want to maintain separates IPs you have to find two different regexes, identifying something as difference,
  • if you're not interested to have different field names for the two IPs, you could use the same regex.

in the first case, try something like this:

your_search
| rex "IP\s+addresses:\s+(?<IP1>\d+\.\d+\.\d+\.\d+).*(?<IP2>\d+\.\d+\.\d+\.\d+)"

if you want also the country associated to each IP, you could use something like this (similar to @etoombs solution) :

your_search
| rex "IP\s+addresses:\s+(?<Country1>[^\(]+)\((?<IP1>\d+\.\d+\.\d+\.\d+).*(?<Country2>[^\(]+)\((?<IP2>\d+\.\d+\.\d+\.\d+)"

I prefer the following solution:

your_search
| rex "(?<Country>[^\(]+)\((?<IP>\d+\.\d+\.\d+\.\d+)"

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @alexspunkshell,

if you could share a sample of your logs I could be more detailed in my answer,

anyway, you have two choices:

  • if you want to maintain separates IPs you have to find two different regexes, identifying something as difference,
  • if you're not interested to have different field names for the two IPs, you could use the same regex.

in the first case, try something like this:

your_search
| rex "IP\s+addresses:\s+(?<IP1>\d+\.\d+\.\d+\.\d+).*(?<IP2>\d+\.\d+\.\d+\.\d+)"

if you want also the country associated to each IP, you could use something like this (similar to @etoombs solution) :

your_search
| rex "IP\s+addresses:\s+(?<Country1>[^\(]+)\((?<IP1>\d+\.\d+\.\d+\.\d+).*(?<Country2>[^\(]+)\((?<IP2>\d+\.\d+\.\d+\.\d+)"

I prefer the following solution:

your_search
| rex "(?<Country>[^\(]+)\((?<IP>\d+\.\d+\.\d+\.\d+)"

Ciao.

Giuseppe

etoombs
Path Finder

If your raw data is always in exactly that format,  |rex field=_raw "IP addresses: (?<Country1>.*)\((?<IP1>.*) and (?<Country2>.*)\((?<IP2>.*)\)"

There's probably a more precise way that would be less error prone, but this might get you started.

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...