Splunk Search

How to write a search to extract an IP address after a line within a Windows security event?


Hello, I have the following:

11/20/2014 11:04:58 AM
SourceName=AD FS 2.0 Auditing

How can I construct a query to get the IP address in the result ? I am looking for a way to get data in the line after http://schemas.microsoft.com/2012/01/requestcontext/claims/x-ms-forwarded-client-ip

0 Karma


Use a Regex, like that:

index=bla "something to search" | rex field=_raw "x-ms-forwarded-client-ip (?P<clientIP>(\d{1,3}\.){3}\d{1,3})"

Now you can see that a new field, named clientIP, will be available for you.


0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...