Splunk Search
Highlighted

How to write the regex to extract the IP address and port number from my log files?

New Member

I have got a field in my log files that is storing failed login IP address "Failed password for invalid user astro from 65.208.122.48 on port 18982". Can anyone suggest how can I extract the IP address and port from text seen in quotations?

0 Karma
Highlighted

Re: How to write the regex to extract the IP address and port number from my log files?

SplunkTrust
SplunkTrust

In search mode you could use rex:

... | rex field=foo "from (?<ipAddress>[^\s]+) on port (?<port>\d+)" | ...
---
If this reply helps you, an upvote would be appreciated.
0 Karma