Splunk Search

Need to extract IP Address

orchapellico
Explorer

I am very new to splunk and still learning, but have a need to get some IP addresses from a very large log file. Basically how the log file works is the IP address is at the end of the line and when that IP errors the following 2 lines in the log give some information on it. But I am needing to build a list of IP's that have errored. The log looks like this:

2012-05-23 00:00:56,578 [6792] INFO  Messaging.Common.LogUtil - UploadServer: Receiving SMail upload request from : 192.168.178.245
2012-05-23 00:00:56,578 [6792] ERROR Messaging.Common.LogUtil - UploadServer: File either not sent or length is invalid
2012-05-23 00:00:56,578 [6792] ERROR Messaging.Common.LogUtil - UploadServer: SMail message NOT stored - Returning error message: 2 - ERROR: File was not valid or no file was attempted to be sent

You notice there is a # in [ ] that is the same as the line that has the IP, this lets us know that this was the IP that had the error. I am not sure how to use these things to get me the list of IP's I need. Thank you for your help.

Tags (1)
1 Solution

araitz
Splunk Employee
Splunk Employee

Try this:

your search | rex "(?<src_ip>\d+\.\d+\.\d+\.\d+)" | rex "\s\[(?<tid>[^\]]+)\]" | transaction tid

The result should be all the events with the same transaction id (tid) grouped together with the src_ip field's value as the IP address in the first event.

View solution in original post

araitz
Splunk Employee
Splunk Employee

Try this:

your search | rex "(?<src_ip>\d+\.\d+\.\d+\.\d+)" | rex "\s\[(?<tid>[^\]]+)\]" | transaction tid

The result should be all the events with the same transaction id (tid) grouped together with the src_ip field's value as the IP address in the first event.

orchapellico
Explorer

Thank you araitz that worked great!

0 Karma

JSapienza
Contributor

If you are trying to pull this IP at search time the easiest thing is to do a simple field extraction.

More info here - InteractiveFieldExtractionExample

0 Karma

joneric_playstu
Engager

Could you please update this link?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...