Splunk Search

How to get ip objects from a Splunk list?

splunknewuser
Loves-to-Learn Everything

Hello, 

I have an output list like this one:

 

 

 

{
    "10.10.10.15": {
    "High": [
      {
        "name": "vu1",
        "nvt_id": "123",
        "port": "",
        "protocol": ""
      }
    ],
    "Medium": [],
    "Low": [],
    "Log": [],
    "False Positive": []
  },
  "10.10.10.24": {
    "High": [
      {
        "name": "vul",
        "nvt_id": "123",
        "port": "",
        "protocol": ""
      }
    ],
    "Medium": [],
    "Low": [],
    "Log": [],
    "False Positive": []
  }
}

 

 

 

I want to get All the IP address and extract the fields in each object.

Labels (1)
Tags (1)
0 Karma

splunknewuser
Loves-to-Learn Everything

I tried to use rex to get the ip addresses:

rex "(?<IP_add>10\.([0-9]{1,3}.){2}[0-9]{1,3})" | table "IP_add".High{}.name

Is it possible to fetch the values of the array using the rex output like that:

rex "(?<ip_add>10\.([0-9]{1,3}.){2}[0-9]{1,3})" | table ip_add.High{}.name

Thank you

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @splunknewuser,

if you ise IP-Add as field name, you have to contniue to use it, if you want a different field name, youcan rename it, but you cannot extract a field called IP_add and the in the table use a different one " ip_add.High{}.name".

then it isn't a good idea to have spaces or special chars (like . or {}) in field names.

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust
0 Karma

splunknewuser
Loves-to-Learn Everything

I tried it but the issue is that the ip has now key?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...