How to write a search to extract an IP address after a line within a Windows security event?

[pyi]

Hello, I have the following:

11/20/2014 11:04:58 AM
LogName=Security
SourceName=AD FS 2.0 Auditing
EventCode=501
.
.
.
http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-forwarded-client-ip
1.1.1.1
.
.
.
.

How can I construct a query to get the IP address in the result ? I am looking for a way to get data in the line after http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-forwarded-client-ip

[musskopf]

Use a Regex, like that:

index=bla "something to search" | rex field=_raw "x-ms-forwarded-client-ip (?P<clientIP>(\d{1,3}\.){3}\d{1,3})"

Now you can see that a new field, named clientIP, will be available for you.

Cheers,