Splunk Search

How to write the regex to extract this IP from my data?

New Member

Hello Team,

I have the below log details and I need to extract only the IP that comes after /. Id remains same for all the commands.

There is no proper field that includes dn, so its hard to extract based on any field.

[2016-02-08T10:29:51.992-05:00] [octetstring] [TRACE] [] [com.octetstring.vde.DoSManager] [tid: 1841020] [ecid: 0000LB1RQ_gB9Dyso4P__m1MAxqb01VGWZ,0] [SRC_CLASS: com.octetstring.vde.util.VDELogger] [SRC_METHOD: debug] UnBind: cn=id,ou=applications,ou=example,ou=example,dc=eg,dc=com/54.16.26.209.

Thanks,
Venkat

0 Karma

Revered Legend

Try something like this (run anywhere sample)

| gentimes start=-1 | eval _raw="[2016-02-08T10:29:51.992-05:00] [octetstring] [TRACE] [] [com.octetstring.vde.DoSManager] [tid: 1841020] [ecid: 0000LB1RQ_gB9Dyso4P__m1MAxqb01VGWZ,0] [SRC_CLASS: com.octetstring.vde.util.VDELogger] [SRC_METHOD: debug] UnBind: cn=id,ou=applications,ou=example,ou=example,dc=eg,dc=com/54.16.26.209." | table _raw 
| rex "dc=\S+\/(?<IPAddress>\d+\.\d+\.\d+\.\d+)"
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!