Splunk Search

Regex for IP Address and URL

prabmurthy
New Member

Hi,

I've 2 fields 1. Host with data which looks something like this ip-10-222-98-898, ip-10-982-83-821, ip-10-233-04-291 etc and other field (say Color) which has some text data example: Red, Yellow, White, Green.

I'd like to have something like this:

  1. Column1 data should look like something like 10-222-98-898, 10-982-83-821 etc
  2. Column2 data should look like http://10-982-83-821/Red (in this case 10-982-83-821 has field value red and so on..

What I was thinking was if I could get #1 ready then I can have a new variable say URL which will look something like URL=http://$host/$Color (I'm not sure of the syntax of how to fetch the fields but my try will look something like this)

How do I get started with #1 and any points for #2?

Thanks in advance.

  • PM
Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Something like this:

...  | rex field=host "(?<ip>\d+-\d+-\d+-\d+)" | eval url = "http://".ip."/".color

If you want to replace the dashes in the host with dots you can throw in this:

... | eval ip = replace(ip, "-", ".") | ...

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Something like this:

...  | rex field=host "(?<ip>\d+-\d+-\d+-\d+)" | eval url = "http://".ip."/".color

If you want to replace the dashes in the host with dots you can throw in this:

... | eval ip = replace(ip, "-", ".") | ...

prabmurthy
New Member

Thanks 🙂 That worked !!

0 Karma
Get Updates on the Splunk Community!

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...