REX IP Address extraction

[dbcase]

Hi,

I have this search in attempting to extract the IP address, but no luck.

blah....|rex "beta.icontrol.com\s(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"|search IP_add="199.61.25.51"

The string looks like this, but the darn thing won't match. Note: I'm very much a beginner with REX

"beta.icontrol.com" 199.61.25.51 "-" - - [05/Aug/2016:12:17:58 -0500] "GET /firmware/lists/BlackList.xml?schemaVersion=1&branding=devpartner&subBranding=System%20Sensor&product=converge&cpeId=0876ff27befe HTTP/1.1" 200 328 0 "-" "-" "-"

[lguinn2]

First, if you want to search for "199.61.25.51", you could just put that in your base search string:

yoursearchhere 199.61.25.51

However, that looks for the ip address if it appears anywhere in the raw data of the event. And if you want to do something with the ip addresses (like report or sort, for example), then you do need the field extraction that rex provides:

yoursearchhere 199.61.25.51
| rex "beta.icontrol.com.\s(?<IP_add>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})"
| where IP_add="199.61.25.51"

Note that I still left the ip address in the base search, where it acts as a filter just like before, and the where refines the events further, only retaining events where the ip address contains the string (and eliminating events that have the ip address somewhere else in the event).

[sundareshr · Accepted solution]

Try this. You were missing the quote and escape .

blah....|rex "beta.icontrol.com"\s(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"|search IP_add="199.61.25.51"

OR since your event appears to have only one IP address pattern, you could just do

.. | rex "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

[dbcase]

As always sundareshr, many thanks!!!!