How to extract only the first three octets of the IP address instead of the whole address?

[samble]

I have the below command to extract the top 100 IP addresses. How can I modify the search to extract only the first three octets of the IP address instead of the whole address?

sourcetype="cisco:asa" | top limit=100 src_ip

[jpolvino]

If you have a field named src_ip that has the full 4-octet IP address, here is one way to modify it in-situ:

| rex field=src_ip mode=sed "/(\d{1,3}\.\d{1,3}\.\d{1,3}).*/\1/g"

This groups the first 3 octets as "group 1" and then replaces the whole field with that group, shown as \1. It also puts a little enforcement on the format of the octets, being a group of 1, 2, or 3 digits.

[jawaharas]

Another way to do

.. | rex field=src_ip "(?<firstthree>.+)\.[0-9]+"

[kmorris_splunk · Accepted solution]

You could use the rex command to extract the first 3 octets into another field and do the top on the new field:

sourcetype="cisco:asa"
| rex field=src_ip "(?<firstthree>\d+)\.\d+\.\d+\.\d+" 
| top limit=100 firstthree

[ssievert_splunk]

Hmmm, looks like your rex should be rex field=src_ip "(?<firstthree>\d+\.\d+\.\d+)\.\d+" instead.

[samble]

Thanks. After doing the search I realized that and changed it to

rex field=src_ip "(?\d+.\d+.\d+).\d+"

Thanks for pointing out the same.