Splunk Search

Regex for IP Address and URL

prabmurthy
New Member

Hi,

I've 2 fields 1. Host with data which looks something like this ip-10-222-98-898, ip-10-982-83-821, ip-10-233-04-291 etc and other field (say Color) which has some text data example: Red, Yellow, White, Green.

I'd like to have something like this:

  1. Column1 data should look like something like 10-222-98-898, 10-982-83-821 etc
  2. Column2 data should look like http://10-982-83-821/Red (in this case 10-982-83-821 has field value red and so on..

What I was thinking was if I could get #1 ready then I can have a new variable say URL which will look something like URL=http://$host/$Color (I'm not sure of the syntax of how to fetch the fields but my try will look something like this)

How do I get started with #1 and any points for #2?

Thanks in advance.

  • PM
Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Something like this:

...  | rex field=host "(?<ip>\d+-\d+-\d+-\d+)" | eval url = "http://".ip."/".color

If you want to replace the dashes in the host with dots you can throw in this:

... | eval ip = replace(ip, "-", ".") | ...

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Something like this:

...  | rex field=host "(?<ip>\d+-\d+-\d+-\d+)" | eval url = "http://".ip."/".color

If you want to replace the dashes in the host with dots you can throw in this:

... | eval ip = replace(ip, "-", ".") | ...

prabmurthy
New Member

Thanks 🙂 That worked !!

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...