Splunk Search

Query logs with IP and not domain name from a field in Splunk

masfar
Engager

Hi- I am trying to search through logs and looking for requests that are using IPs(IPv4) rather than domain name. How do I perform such query from a field, X?

For example:
111.222.333.444/abc.txt
myexample.com/xyz.txt

I want to look for logs with fields like line 1 and not line 2.

Thanks,
MA

Tags (1)
0 Karma

DalJeanis
Legend

This will test whether an ip address is anywhere in HostFieldName

... | eval n=if(match(HostFieldName,"\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}"), 1,0)

so, it would match WE123.456.789.012FX as well as your examples.

With minor adjustments, you could also use it something like this -

... | search match(HostFieldName,"\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}")
0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

  Ready to master Kubernetes and cloud monitoring like the pros?Join Splunk’s Growth Engineering team for an ...

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...