Splunk Search
Highlighted

Multivalue Regex capture

Path Finder

If I have an event with more than one IP addres in it, how can I write a regex that will capture all of the IP's?

Example: Website1 A.B.C.D POST /site/page.asmx - 80 - Z.Y.X.W UserAgentX 401 1 0

Thanks!

Tags (2)
0 Karma
Highlighted

Re: Multivalue Regex capture

Super Champion

See How do I find all unique IP addresses in a file?


Basically you can find ip interactivly using a search command:

| rex max_match=100 "\b(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\b" 

Or you can setup an automatic field extraction in your props.conf and transforms.conf files.

props.conf:

[my_source_type]
REPORT-ips = all_the_ips

transforms.conf:

[all_the_ips]
REGEX = \b(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\b
MV_ADD = True

View solution in original post