How to extract a field from my raw data using rex?

[alexspunkshell]

In my splunk logs, i have 2 IPs in 1 field name.

I want to extract both IPs create a new field as IP1 & IP2. Please help here.

The user XYZ was involved in an impossible travel incident. The user connected from two countries within 280 minutes, from these IP addresses: United States (205.000.000.0) and Italy (37.000.000.00). If any of these IP addresses are used by the organization for VPN connections and do not necessarily represent a physical location, we recommend categorizing them as VPN in the IP Address range page in Microsoft Defender for Cloud Apps portal to avoid false alerts.

Example

IP1 - 205.000.000.0

IP2 - 37.000.000.00

[gcusello · Accepted solution]

Hi @alexspunkshell,

if you could share a sample of your logs I could be more detailed in my answer,

anyway, you have two choices:

• if you want to maintain separates IPs you have to find two different regexes, identifying something as difference,
• if you're not interested to have different field names for the two IPs, you could use the same regex.

in the first case, try something like this:

your_search
| rex "IP\s+addresses:\s+(?<IP1>\d+\.\d+\.\d+\.\d+).*(?<IP2>\d+\.\d+\.\d+\.\d+)"

if you want also the country associated to each IP, you could use something like this (similar to @etoombs solution) :

your_search
| rex "IP\s+addresses:\s+(?<Country1>[^\(]+)\((?<IP1>\d+\.\d+\.\d+\.\d+).*(?<Country2>[^\(]+)\((?<IP2>\d+\.\d+\.\d+\.\d+)"

I prefer the following solution:

your_search
| rex "(?<Country>[^\(]+)\((?<IP>\d+\.\d+\.\d+\.\d+)"

Ciao.

Giuseppe

[etoombs]

If your raw data is always in exactly that format,  |rex field=_raw "IP addresses: (?<Country1>.*)\((?<IP1>.*) and (?<Country2>.*)\((?<IP2>.*)\)"

There's probably a more precise way that would be less error prone, but this might get you started.