Splunk Search

How to extract a field from my raw data using rex?

alexspunkshell
Contributor

In my splunk logs, i have 2 IPs in 1 field name.

I want to extract both IPs create a new field as IP1 & IP2. Please help here.

The user XYZ was involved in an impossible travel incident. The user connected from two countries within 280 minutes, from these IP addresses: United States (205.000.000.0) and Italy (37.000.000.00). If any of these IP addresses are used by the organization for VPN connections and do not necessarily represent a physical location, we recommend categorizing them as VPN in the IP Address range page in Microsoft Defender for Cloud Apps portal to avoid false alerts.

 

Example

IP1 - 205.000.000.0

IP2 - 37.000.000.00

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @alexspunkshell,

if you could share a sample of your logs I could be more detailed in my answer,

anyway, you have two choices:

  • if you want to maintain separates IPs you have to find two different regexes, identifying something as difference,
  • if you're not interested to have different field names for the two IPs, you could use the same regex.

in the first case, try something like this:

your_search
| rex "IP\s+addresses:\s+(?<IP1>\d+\.\d+\.\d+\.\d+).*(?<IP2>\d+\.\d+\.\d+\.\d+)"

if you want also the country associated to each IP, you could use something like this (similar to @etoombs solution) :

your_search
| rex "IP\s+addresses:\s+(?<Country1>[^\(]+)\((?<IP1>\d+\.\d+\.\d+\.\d+).*(?<Country2>[^\(]+)\((?<IP2>\d+\.\d+\.\d+\.\d+)"

I prefer the following solution:

your_search
| rex "(?<Country>[^\(]+)\((?<IP>\d+\.\d+\.\d+\.\d+)"

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @alexspunkshell,

if you could share a sample of your logs I could be more detailed in my answer,

anyway, you have two choices:

  • if you want to maintain separates IPs you have to find two different regexes, identifying something as difference,
  • if you're not interested to have different field names for the two IPs, you could use the same regex.

in the first case, try something like this:

your_search
| rex "IP\s+addresses:\s+(?<IP1>\d+\.\d+\.\d+\.\d+).*(?<IP2>\d+\.\d+\.\d+\.\d+)"

if you want also the country associated to each IP, you could use something like this (similar to @etoombs solution) :

your_search
| rex "IP\s+addresses:\s+(?<Country1>[^\(]+)\((?<IP1>\d+\.\d+\.\d+\.\d+).*(?<Country2>[^\(]+)\((?<IP2>\d+\.\d+\.\d+\.\d+)"

I prefer the following solution:

your_search
| rex "(?<Country>[^\(]+)\((?<IP>\d+\.\d+\.\d+\.\d+)"

Ciao.

Giuseppe

etoombs
Path Finder

If your raw data is always in exactly that format,  |rex field=_raw "IP addresses: (?<Country1>.*)\((?<IP1>.*) and (?<Country2>.*)\((?<IP2>.*)\)"

There's probably a more precise way that would be less error prone, but this might get you started.

Get Updates on the Splunk Community!

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...