Splunk Search

Regex expression to extract IP from a raw log file

ssaini5
Explorer

Hi all,

I am trying to extract an IP and the word "HOST_NAME" from a raw log file using the following regex expression: 

source="/var/tmp/test.log" | rex field=_raw "(?<HOST_NAME>) \b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b"

 

Log file:

EXEC_ID: HOST_NAME: 172.19.20.60 USER_NAME: test ================================  TestCaseRunner Summary ----------------------------- Time Taken: 13844ms Total TestSuites: 2 Total TestCases: 6 (0 failed) Total TestSteps: 16 Total Request Assertions: 19 Total Failed Assertions: 0 Total Exported Results: 0

 

The search results are not extracting the HOST_NAME field and the respective IP. Please suggest what should I change. 

Thank you 

 

Labels (3)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

Try changing second hostname in rex command. Say test for example and and see if you are getting ip into it.

————————————
If this helps, give a like below.

View solution in original post

thambisetty
SplunkTrust
SplunkTrust

| rex “HOST_NAME:\s+(?<HOST_NAME>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})”

————————————
If this helps, give a like below.

ssaini5
Explorer

Hi @thambisetty ,

 

Thanks for the reply. The search is working but the field "HOST_NAME" is still not extracted as a separate field on which I can filter on further.  

0 Karma

thambisetty
SplunkTrust
SplunkTrust

Try changing second hostname in rex command. Say test for example and and see if you are getting ip into it.

————————————
If this helps, give a like below.

ssaini5
Explorer

That worked thanks a ton 🙂 

0 Karma

thambisetty
SplunkTrust
SplunkTrust

Great.

Up vote is rally appreciated.

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...