Splunk Search

Query logs with IP and not domain name from a field in Splunk

masfar
Engager

Hi- I am trying to search through logs and looking for requests that are using IPs(IPv4) rather than domain name. How do I perform such query from a field, X?

For example:
111.222.333.444/abc.txt
myexample.com/xyz.txt

I want to look for logs with fields like line 1 and not line 2.

Thanks,
MA

Tags (1)
0 Karma

DalJeanis
Legend

This will test whether an ip address is anywhere in HostFieldName

... | eval n=if(match(HostFieldName,"\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"), 1,0)

so, it would match WE123.456.789.012FX as well as your examples.

With minor adjustments, you could also use it something like this -

... | search match(HostFieldName,"\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}")
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...