Splunk Search

REX IP Address extraction

dbcase
Motivator

Hi,

I have this search in attempting to extract the IP address, but no luck.

blah....|rex "beta.icontrol.com\s(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"|search IP_add="199.61.25.51"

The string looks like this, but the darn thing won't match. Note: I'm very much a beginner with REX

"beta.icontrol.com" 199.61.25.51 "-" - - [05/Aug/2016:12:17:58 -0500] "GET /firmware/lists/BlackList.xml?schemaVersion=1&branding=devpartner&subBranding=System%20Sensor&product=converge&cpeId=0876ff27befe HTTP/1.1" 200 328 0 "-" "-" "-"
0 Karma
1 Solution

sundareshr
Legend

Try this. You were missing the quote and escape .

blah....|rex "beta.icontrol.com"\s(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"|search IP_add="199.61.25.51"

OR since your event appears to have only one IP address pattern, you could just do

.. | rex "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

View solution in original post

lguinn2
Legend

First, if you want to search for "199.61.25.51", you could just put that in your base search string:

yoursearchhere 199.61.25.51

However, that looks for the ip address if it appears anywhere in the raw data of the event. And if you want to do something with the ip addresses (like report or sort, for example), then you do need the field extraction that rex provides:

yoursearchhere 199.61.25.51
| rex "beta.icontrol.com.\s(?<IP_add>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})"
| where IP_add="199.61.25.51"

Note that I still left the ip address in the base search, where it acts as a filter just like before, and the where refines the events further, only retaining events where the ip address contains the string (and eliminating events that have the ip address somewhere else in the event).

0 Karma

sundareshr
Legend

Try this. You were missing the quote and escape .

blah....|rex "beta.icontrol.com"\s(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"|search IP_add="199.61.25.51"

OR since your event appears to have only one IP address pattern, you could just do

.. | rex "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

dbcase
Motivator

As always sundareshr, many thanks!!!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...