Splunk Search

How to extract ip address using regex?

karthi2809
Builder

index="testd" | rex field=_raw "Remote host:(?.*):" |dedup Remotehost |stats count by Remotehost

My events:

Remote host:

2.136.12.186

:34126]@684574 useCount=1 bytesRead=0 bytesWritten=2994631 age=163708ms lastIO=5ms ))).onExceptionWrite exception

Expected output:

2.136.12.186

Thanks in advance

0 Karma
1 Solution

FrankVl
Ultra Champion

Can you please post search code and event strings as code (use the 101010 button in the editor), otherwise some parts will get messed up due to how the board handles certain special characters.

In general, to strictly extract an IP address, use a regex like this: \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}

So for you example, you should probably use something like:

index="testd" | rex field=_raw "Remote host:(?<Remotehost>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

View solution in original post

xpac
SplunkTrust
SplunkTrust

There is literally a million valid regexes on the Internet to extract IP addresses.

Assuming the following:

  • You only have IPv4 addresses
  • They're always at the beginning of the event

You could use this regex: ^((?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)

Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂

0 Karma

FrankVl
Ultra Champion

Can you please post search code and event strings as code (use the 101010 button in the editor), otherwise some parts will get messed up due to how the board handles certain special characters.

In general, to strictly extract an IP address, use a regex like this: \d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}

So for you example, you should probably use something like:

index="testd" | rex field=_raw "Remote host:(?<Remotehost>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

gcusello
SplunkTrust
SplunkTrust

Hi
try with this regex

index="testd" 
| rex "(?ms)Remote host:\s+(?<Remotehost>\d+\.\d+\.\d+\.\d+)"
| dedup Remotehost 
| stats count by Remotehost

that you can test at https://regex101.com/r/NZkwci/2
Only one question: why do you dedup by Remotehost and then use stats count? result will be always 1!

Bye.
Giuseppe

tfujita_splunk
Splunk Employee
Splunk Employee

I created a Splunk Macros for regular expressions for IPv4 addresses.

Definitions and usages are in an article below.

 https://qiita.com/Joh256/private/659ef65897905890ef99.

I also put them in an add-on below.

https://splunkbase.splunk.com/app/6595

 

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

What Is Splunk? Here’s What You Can Do with Splunk

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...