Splunk Search

Multivalue Regex capture

Path Finder

If I have an event with more than one IP addres in it, how can I write a regex that will capture all of the IP's?

Example: Website1 A.B.C.D POST /site/page.asmx - 80 - Z.Y.X.W UserAgentX 401 1 0


Tags (2)
0 Karma

Re: Multivalue Regex capture

Super Champion

See How do I find all unique IP addresses in a file?

Basically you can find ip interactivly using a search command:

| rex max_match=100 "\b(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\b" 

Or you can setup an automatic field extraction in your props.conf and transforms.conf files.


REPORT-ips = all_the_ips


REGEX = \b(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\b
MV_ADD = True

View solution in original post