Splunk Search

Regex - find second match?

Explorer

Was hoping I could get some help with extracting a field. I have a line that looks like:

"2010-10-08 16:04:10 0.0.0.0 21 3236 255.255.255.255 22821 2312 username 0 0 - 22 Back from VerifyPassword(user=username), bPasswordOK=1, iRetCode=0"

I want to extract the 255.255.255.255 as src_ip. I understand how to extract the field but I can't come up with a regex that extracts only that second IP address (as it's the source, first is the destination and is always the same, of course these are made up in this example. I don't have broadcast addresses logging into my server). I even downloaded regexbuddy but I still can't figure it out because I'm lame.

Any help would be greatly appreciated.

Tags (1)
1 Solution

SplunkTrust
SplunkTrust

I think this will work - this is in transforms.conf style:

[mylookup]
REGEX=\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2} ([^\s]+) \d+ \d+ ([^\s]+)
FORMAT=src_ip::$2 dest_ip::$1

View solution in original post

SplunkTrust
SplunkTrust

I think this will work - this is in transforms.conf style:

[mylookup]
REGEX=\d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2} ([^\s]+) \d+ \d+ ([^\s]+)
FORMAT=src_ip::$2 dest_ip::$1

View solution in original post

Explorer

Worked. Thanks man! Very quick response too.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!