Splunk Search

How to extract an IP address across different pattern of events?

New Member

I'm trying to extract IP (v4) addresses from different events. For instance, for an event such as:

[...] sent ping to [...]

this rex command works just fine:

| rex field=_raw " (?<node_ip_1>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}):"

and for events such as:

[...] paired node xxxxxx@ [...]

this slightly changed regex works as well:

rex field=_raw"@(?<node_ip_2>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

And so on. 🙂 The problem is that these IP addresses are located in different places according to the type of events, so one rex command does not fit all patterns. Field extraction wizard for regular expressions also gets confused and only gets it right in some cases, but mostly gets it wrong.

Is there a way to tell rex to match pattern_1 OR pattern2 OR pattern3 and so on?

Or am I looking at this the wrong way?

0 Karma

New Member

Just to clarify, I have 3 types of messages - by which I mean the IP address is surrounded by different characters:

(the underscore char represents a space):

  1. _HOST-IP-ADDRESS_ ( <- not interested in extracting this)



  4. _IP_ADDRESS_/

Thus far I created 3 separate searches for which rex works just fine. Can I reduce it to one search only.
Basically, a way to tell rex: if IP_ADDRESS is preceded by space OR @ AND followed by colon OR space/

0 Karma

Esteemed Legend

Hi luca1,
did you symply tried with (?<IP>\d+\.\d+\.\d+\.\d+) ?
You can test it at https://regex101.com/r/uUg67f/1
It extract your IP addresses from each log.

If yoy want also extract the port (when present), you can add another different extraction \d+\.\d+\.\d+\.\d+:(?<port>\d+) .


New Member

Hi Giuseppe,
I forgot to mention that the host IP is also in the events, so I need a way to differentiate it from the (source) IP I'm after; hence the leading space or "@" characters as needed, I think. 🙂 Is there any way to match several leading / trailing characters in regex, something like [\s|@|:] just an example.


0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...