Splunk Search

How to extract only IP's from text?

harishnpandey
Explorer
trans(776800911)[10.173.36.75]: Request processing failed: Network Error, from URL: 10.173.36.73:57743
trans(776800912)[10.173.36.75]: Request processing failed: Network Error, from URL: 10.173.36.74:57743
trans(776800913)[10.173.36.75]: Request processing failed: Network Error, from URL: 10.173.36.75:57743
Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

If this is to be extracted from raw data (_raw field),

your search 
| rex "URL\:\s*(?<IP_Address>\d+\.\d+\.\d+\.\d+)"

If this is to be extracted from some other field (for example from field name "Message"),

your search 
| rex field=Message "URL\:\s*(?<IP_Address>\d+\.\d+\.\d+\.\d+)"

View solution in original post

harishnpandey
Explorer

Could you please explain how this works ==> \s*(?\d+.\d+.\d+.\d+)

0 Karma

jkat54
SplunkTrust
SplunkTrust

See regex101.com

 \s = space
 \d+ = any number of digits
 \. = dot

This regex could identify non-ip addresses too. For example, it would match 1234.5678.9012.34567890 too, which is clearly not an up address.

0 Karma

harishnpandey
Explorer

Thanks a lot for quick response. It really helps

0 Karma

somesoni2
Revered Legend

Try like this

If this is to be extracted from raw data (_raw field),

your search 
| rex "URL\:\s*(?<IP_Address>\d+\.\d+\.\d+\.\d+)"

If this is to be extracted from some other field (for example from field name "Message"),

your search 
| rex field=Message "URL\:\s*(?<IP_Address>\d+\.\d+\.\d+\.\d+)"
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...