How to write the regex to extract the IP address a...

bluesaint · ‎06-19-2016

I have got a field in my log files that is storing failed login IP address "Failed password for invalid user astro from 65.208.122.48 on port 18982". Can anyone suggest how can I extract the IP address and port from text seen in quotations?

richgalloway · ‎06-19-2016

In search mode you could use rex:

... | rex field=foo "from (?<ipAddress>[^\s]+) on port (?<port>\d+)" | ...

---
If this reply helps you, Karma would be appreciated.

How to write the regex to extract the IP address and port number from my log files?

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Join the Conversation

How to write the regex to extract the IP address and port number from my log files?

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...