Need to pull IP from Message field

[radalliance]

Hey all, I'm trying to separate out the IP address (Source Network Address:) from the Windows event Message field. I'm trying to find every instance of authentication for a certain user acct (including services & IIS app pools), but I'm having to parse it from the logs I'm getting from our Domain controllers.

I'm pretty new to Splunk so my search is fairly basic. This is all I have so far, and I haven't been able to find info on whether that rex field should equal the new field I'm trying to create, or the field I'm searching, or what:

index=* user=username EventCode=4740 OR EventCode=4648 OR EventCode=4672 OR EventCode=4624 | rex field=ServerIP "Source Network Address:(?<Message>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

So what I'm trying to do:

Search Windows event log "Message" field > Find string "Source Network Address:ipaddress"

Create new field with Value being above IP address

Appreciate any help!

[gcusello · Accepted solution]

Hi @radalliance,

are you sure that you already haven't that field? I have in my logs with the field name "IpAddress"

Anyway, with this regex I'm able to extract it:

| rex "(?<IP>\d+\.\d+\.\d+\.\d+)"

Ciao.

Giuseppe

[radalliance]

Perfect, thank you. Removed the extra eventID search and was able to return just what I needed with the following:

index=* user=username | rex "(?<IP>\d+\.\d+\.\d+\.\d+)" | stats count by IP | lookup dnslookup clientip as IP OUTPUT clienthost as host | sort - count | table IP, host, count | fields "IP", "host", "count"

[gcusello]

Hi @radalliance,

good for you, see next time.

Ciao and happy splunking.

Giuseppe.

P.S.: Karma Points are appreciated 😉