Splunk Search

How to write a search to extract an IP address after a line within a Windows security event?

pyi
Engager

Hello, I have the following:

11/20/2014 11:04:58 AM
LogName=Security
SourceName=AD FS 2.0 Auditing
EventCode=501
.
.
.
http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-forwarded-client-ip
1.1.1.1
.
.
.
.

How can I construct a query to get the IP address in the result ? I am looking for a way to get data in the line after http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-forwarded-client-ip

0 Karma

musskopf
Builder

Use a Regex, like that:

index=bla "something to search" | rex field=_raw "x-ms-forwarded-client-ip (?P<clientIP>(\d{1,3}\.){3}\d{1,3})"

Now you can see that a new field, named clientIP, will be available for you.

Cheers,

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...