Splunk Search

Regex expression to extract IP from a raw log file

Explorer

Hi all,

I am trying to extract an IP and the word "HOST_NAME" from a raw log file using the following regex expression: 

source="/var/tmp/test.log" | rex field=_raw "(?<HOST_NAME>) \b(?:[0-9]{1,3}\.){3}[0-9]{1,3}\b"

 

Log file:

EXEC_ID: HOST_NAME: 172.19.20.60 USER_NAME: test ================================  TestCaseRunner Summary ----------------------------- Time Taken: 13844ms Total TestSuites: 2 Total TestCases: 6 (0 failed) Total TestSteps: 16 Total Request Assertions: 19 Total Failed Assertions: 0 Total Exported Results: 0

 

The search results are not extracting the HOST_NAME field and the respective IP. Please suggest what should I change. 

Thank you 

 

Labels (3)
0 Karma
1 Solution

Super Champion

Try changing second hostname in rex command. Say test for example and and see if you are getting ip into it.

————————————
If this helps, give a like below.

View solution in original post

Super Champion

| rex “HOST_NAME:\s+(?<HOST_NAME>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})”

————————————
If this helps, give a like below.

Explorer

Hi @thambisetty ,

 

Thanks for the reply. The search is working but the field "HOST_NAME" is still not extracted as a separate field on which I can filter on further.  

0 Karma

Super Champion

Try changing second hostname in rex command. Say test for example and and see if you are getting ip into it.

————————————
If this helps, give a like below.

View solution in original post

Explorer

That worked thanks a ton 🙂 

0 Karma

Super Champion

Great.

Up vote is rally appreciated.

————————————
If this helps, give a like below.
0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!