Splunk Search

Regex for IP Address and URL

prabmurthy
New Member

Hi,

I've 2 fields 1. Host with data which looks something like this ip-10-222-98-898, ip-10-982-83-821, ip-10-233-04-291 etc and other field (say Color) which has some text data example: Red, Yellow, White, Green.

I'd like to have something like this:

  1. Column1 data should look like something like 10-222-98-898, 10-982-83-821 etc
  2. Column2 data should look like http://10-982-83-821/Red (in this case 10-982-83-821 has field value red and so on..

What I was thinking was if I could get #1 ready then I can have a new variable say URL which will look something like URL=http://$host/$Color (I'm not sure of the syntax of how to fetch the fields but my try will look something like this)

How do I get started with #1 and any points for #2?

Thanks in advance.

  • PM
Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Something like this:

...  | rex field=host "(?<ip>\d+-\d+-\d+-\d+)" | eval url = "http://".ip."/".color

If you want to replace the dashes in the host with dots you can throw in this:

... | eval ip = replace(ip, "-", ".") | ...

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Something like this:

...  | rex field=host "(?<ip>\d+-\d+-\d+-\d+)" | eval url = "http://".ip."/".color

If you want to replace the dashes in the host with dots you can throw in this:

... | eval ip = replace(ip, "-", ".") | ...

prabmurthy
New Member

Thanks 🙂 That worked !!

0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...