Splunk Search

Regex expression to extract IP from a raw log file

ssaini5
Explorer

Hi all,

I am trying to extract an IP and the word "HOST_NAME" from a raw log file using the following regex expression: 

source="/var/tmp/test.log" | rex field=_raw "(?<HOST_NAME>) \b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b"

 

Log file:

EXEC_ID: HOST_NAME: 172.19.20.60 USER_NAME: test ================================  TestCaseRunner Summary ----------------------------- Time Taken: 13844ms Total TestSuites: 2 Total TestCases: 6 (0 failed) Total TestSteps: 16 Total Request Assertions: 19 Total Failed Assertions: 0 Total Exported Results: 0

 

The search results are not extracting the HOST_NAME field and the respective IP. Please suggest what should I change. 

Thank you 

 

Labels (3)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

Try changing second hostname in rex command. Say test for example and and see if you are getting ip into it.

————————————
If this helps, give a like below.

View solution in original post

thambisetty
SplunkTrust
SplunkTrust

| rex “HOST_NAME:\s+(?<HOST_NAME>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})”

————————————
If this helps, give a like below.

ssaini5
Explorer

Hi @thambisetty ,

 

Thanks for the reply. The search is working but the field "HOST_NAME" is still not extracted as a separate field on which I can filter on further.  

0 Karma

thambisetty
SplunkTrust
SplunkTrust

Try changing second hostname in rex command. Say test for example and and see if you are getting ip into it.

————————————
If this helps, give a like below.

ssaini5
Explorer

That worked thanks a ton 🙂 

0 Karma

thambisetty
SplunkTrust
SplunkTrust

Great.

Up vote is rally appreciated.

————————————
If this helps, give a like below.
0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...