trans(776800911)[10.173.36.75]: Request processing failed: Network Error, from URL: 10.173.36.73:57743
trans(776800912)[10.173.36.75]: Request processing failed: Network Error, from URL: 10.173.36.74:57743
trans(776800913)[10.173.36.75]: Request processing failed: Network Error, from URL: 10.173.36.75:57743
Try like this
If this is to be extracted from raw data (_raw field),
your search
| rex "URL\:\s*(?<IP_Address>\d+\.\d+\.\d+\.\d+)"
If this is to be extracted from some other field (for example from field name "Message"),
your search
| rex field=Message "URL\:\s*(?<IP_Address>\d+\.\d+\.\d+\.\d+)"
Could you please explain how this works ==> \s*(?\d+.\d+.\d+.\d+)
See regex101.com
\s = space
\d+ = any number of digits
\. = dot
This regex could identify non-ip addresses too. For example, it would match 1234.5678.9012.34567890 too, which is clearly not an up address.
Thanks a lot for quick response. It really helps
Try like this
If this is to be extracted from raw data (_raw field),
your search
| rex "URL\:\s*(?<IP_Address>\d+\.\d+\.\d+\.\d+)"
If this is to be extracted from some other field (for example from field name "Message"),
your search
| rex field=Message "URL\:\s*(?<IP_Address>\d+\.\d+\.\d+\.\d+)"