Splunk Search

How to extract only IP's from text?

harishnpandey
Explorer
trans(776800911)[10.173.36.75]: Request processing failed: Network Error, from URL: 10.173.36.73:57743
trans(776800912)[10.173.36.75]: Request processing failed: Network Error, from URL: 10.173.36.74:57743
trans(776800913)[10.173.36.75]: Request processing failed: Network Error, from URL: 10.173.36.75:57743
Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

If this is to be extracted from raw data (_raw field),

your search 
| rex "URL\:\s*(?<IP_Address>\d+\.\d+\.\d+\.\d+)"

If this is to be extracted from some other field (for example from field name "Message"),

your search 
| rex field=Message "URL\:\s*(?<IP_Address>\d+\.\d+\.\d+\.\d+)"

View solution in original post

harishnpandey
Explorer

Could you please explain how this works ==> \s*(?\d+.\d+.\d+.\d+)

0 Karma

jkat54
SplunkTrust
SplunkTrust

See regex101.com

 \s = space
 \d+ = any number of digits
 \. = dot

This regex could identify non-ip addresses too. For example, it would match 1234.5678.9012.34567890 too, which is clearly not an up address.

0 Karma

harishnpandey
Explorer

Thanks a lot for quick response. It really helps

0 Karma

somesoni2
Revered Legend

Try like this

If this is to be extracted from raw data (_raw field),

your search 
| rex "URL\:\s*(?<IP_Address>\d+\.\d+\.\d+\.\d+)"

If this is to be extracted from some other field (for example from field name "Message"),

your search 
| rex field=Message "URL\:\s*(?<IP_Address>\d+\.\d+\.\d+\.\d+)"

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!