Splunk Search

REX IP Address extraction

dbcase
Motivator

Hi,

I have this search in attempting to extract the IP address, but no luck.

blah....|rex "beta.icontrol.com\s(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"|search IP_add="199.61.25.51"

The string looks like this, but the darn thing won't match. Note: I'm very much a beginner with REX

"beta.icontrol.com" 199.61.25.51 "-" - - [05/Aug/2016:12:17:58 -0500] "GET /firmware/lists/BlackList.xml?schemaVersion=1&branding=devpartner&subBranding=System%20Sensor&product=converge&cpeId=0876ff27befe HTTP/1.1" 200 328 0 "-" "-" "-"
0 Karma
1 Solution

sundareshr
Legend

Try this. You were missing the quote and escape .

blah....|rex "beta.icontrol.com"\s(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"|search IP_add="199.61.25.51"

OR since your event appears to have only one IP address pattern, you could just do

.. | rex "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

View solution in original post

lguinn2
Legend

First, if you want to search for "199.61.25.51", you could just put that in your base search string:

yoursearchhere 199.61.25.51

However, that looks for the ip address if it appears anywhere in the raw data of the event. And if you want to do something with the ip addresses (like report or sort, for example), then you do need the field extraction that rex provides:

yoursearchhere 199.61.25.51
| rex "beta.icontrol.com.\s(?<IP_add>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})"
| where IP_add="199.61.25.51"

Note that I still left the ip address in the base search, where it acts as a filter just like before, and the where refines the events further, only retaining events where the ip address contains the string (and eliminating events that have the ip address somewhere else in the event).

0 Karma

sundareshr
Legend

Try this. You were missing the quote and escape .

blah....|rex "beta.icontrol.com"\s(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"|search IP_add="199.61.25.51"

OR since your event appears to have only one IP address pattern, you could just do

.. | rex "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

dbcase
Motivator

As always sundareshr, many thanks!!!!

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...