Splunk Search

Multivalue Regex capture

Derek
Path Finder

If I have an event with more than one IP addres in it, how can I write a regex that will capture all of the IP's?

Example: Website1 A.B.C.D POST /site/page.asmx - 80 - Z.Y.X.W UserAgentX 401 1 0

Thanks!

Tags (2)
0 Karma
1 Solution

Lowell
Super Champion

See How do I find all unique IP addresses in a file?


Basically you can find ip interactivly using a search command:

| rex max_match=100 "\b(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\b" 

Or you can setup an automatic field extraction in your props.conf and transforms.conf files.

props.conf:

[my_source_type]
REPORT-ips = all_the_ips

transforms.conf:

[all_the_ips]
REGEX = \b(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\b
MV_ADD = True

View solution in original post

Lowell
Super Champion

See How do I find all unique IP addresses in a file?


Basically you can find ip interactivly using a search command:

| rex max_match=100 "\b(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\b" 

Or you can setup an automatic field extraction in your props.conf and transforms.conf files.

props.conf:

[my_source_type]
REPORT-ips = all_the_ips

transforms.conf:

[all_the_ips]
REGEX = \b(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\b
MV_ADD = True
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Hi Splunky people! We are excited to share the newest updates in Splunk Enterprise 9.3!Admins and Analyst can ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...