Splunk Search

REX IP Address extraction

dbcase
Motivator

Hi,

I have this search in attempting to extract the IP address, but no luck.

blah....|rex "beta.icontrol.com\s(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"|search IP_add="199.61.25.51"

The string looks like this, but the darn thing won't match. Note: I'm very much a beginner with REX

"beta.icontrol.com" 199.61.25.51 "-" - - [05/Aug/2016:12:17:58 -0500] "GET /firmware/lists/BlackList.xml?schemaVersion=1&branding=devpartner&subBranding=System%20Sensor&product=converge&cpeId=0876ff27befe HTTP/1.1" 200 328 0 "-" "-" "-"
0 Karma
1 Solution

sundareshr
Legend

Try this. You were missing the quote and escape .

blah....|rex "beta.icontrol.com"\s(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"|search IP_add="199.61.25.51"

OR since your event appears to have only one IP address pattern, you could just do

.. | rex "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

View solution in original post

lguinn2
Legend

First, if you want to search for "199.61.25.51", you could just put that in your base search string:

yoursearchhere 199.61.25.51

However, that looks for the ip address if it appears anywhere in the raw data of the event. And if you want to do something with the ip addresses (like report or sort, for example), then you do need the field extraction that rex provides:

yoursearchhere 199.61.25.51
| rex "beta.icontrol.com.\s(?<IP_add>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})"
| where IP_add="199.61.25.51"

Note that I still left the ip address in the base search, where it acts as a filter just like before, and the where refines the events further, only retaining events where the ip address contains the string (and eliminating events that have the ip address somewhere else in the event).

0 Karma

sundareshr
Legend

Try this. You were missing the quote and escape .

blah....|rex "beta.icontrol.com"\s(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"|search IP_add="199.61.25.51"

OR since your event appears to have only one IP address pattern, you could just do

.. | rex "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

dbcase
Motivator

As always sundareshr, many thanks!!!!

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...