Splunk Search
Highlighted

REX IP Address extraction

Motivator

Hi,

I have this search in attempting to extract the IP address, but no luck.

blah....|rex "beta.icontrol.com\s(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"|search IP_add="199.61.25.51"

The string looks like this, but the darn thing won't match. Note: I'm very much a beginner with REX

"beta.icontrol.com" 199.61.25.51 "-" - - [05/Aug/2016:12:17:58 -0500] "GET /firmware/lists/BlackList.xml?schemaVersion=1&branding=devpartner&subBranding=System%20Sensor&product=converge&cpeId=0876ff27befe HTTP/1.1" 200 328 0 "-" "-" "-"
0 Karma
Highlighted

Re: REX IP Address extraction

Legend

Try this. You were missing the quote and escape .

blah....|rex "beta.icontrol.com"\s(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"|search IP_add="199.61.25.51"

OR since your event appears to have only one IP address pattern, you could just do

.. | rex "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

View solution in original post

0 Karma
Highlighted

Re: REX IP Address extraction

Motivator

As always sundareshr, many thanks!!!!

0 Karma
Highlighted

Re: REX IP Address extraction

Legend

First, if you want to search for "199.61.25.51", you could just put that in your base search string:

yoursearchhere 199.61.25.51

However, that looks for the ip address if it appears anywhere in the raw data of the event. And if you want to do something with the ip addresses (like report or sort, for example), then you do need the field extraction that rex provides:

yoursearchhere 199.61.25.51
| rex "beta.icontrol.com.\s(?<IP_add>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})"
| where IP_add="199.61.25.51"

Note that I still left the ip address in the base search, where it acts as a filter just like before, and the where refines the events further, only retaining events where the ip address contains the string (and eliminating events that have the ip address somewhere else in the event).

0 Karma