Splunk Search

How to extract only IP's from text?

harishnpandey
Explorer
trans(776800911)[10.173.36.75]: Request processing failed: Network Error, from URL: 10.173.36.73:57743
trans(776800912)[10.173.36.75]: Request processing failed: Network Error, from URL: 10.173.36.74:57743
trans(776800913)[10.173.36.75]: Request processing failed: Network Error, from URL: 10.173.36.75:57743
Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

If this is to be extracted from raw data (_raw field),

your search 
| rex "URL\:\s*(?<IP_Address>\d+\.\d+\.\d+\.\d+)"

If this is to be extracted from some other field (for example from field name "Message"),

your search 
| rex field=Message "URL\:\s*(?<IP_Address>\d+\.\d+\.\d+\.\d+)"

View solution in original post

harishnpandey
Explorer

Could you please explain how this works ==> \s*(?\d+.\d+.\d+.\d+)

0 Karma

jkat54
SplunkTrust
SplunkTrust

See regex101.com

 \s = space
 \d+ = any number of digits
 \. = dot

This regex could identify non-ip addresses too. For example, it would match 1234.5678.9012.34567890 too, which is clearly not an up address.

0 Karma

harishnpandey
Explorer

Thanks a lot for quick response. It really helps

0 Karma

somesoni2
Revered Legend

Try like this

If this is to be extracted from raw data (_raw field),

your search 
| rex "URL\:\s*(?<IP_Address>\d+\.\d+\.\d+\.\d+)"

If this is to be extracted from some other field (for example from field name "Message"),

your search 
| rex field=Message "URL\:\s*(?<IP_Address>\d+\.\d+\.\d+\.\d+)"
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...