Splunk Search

Regex for last IP Address

VS0909
Communicator

Can someone please help with the Splunk query for the below scenario:

I want to extract last IP address by a regular expression (regex) , for an event which has one or more IP addresses.

If the event has one IP ---> then extract that IP

If the event has more than one IP ---> then extract the last IP

Thanks!

0 Karma

PickleRick
SplunkTrust
SplunkTrust

(?<ip>\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b)(?!.*\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b)

Ugly as hell, and of course doesn't check for validity of the IP (accepts any 1-3 digit sequences, even ridiculous like 345.912.123.0). Regex is not the best tool to validate IP-s

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you share some example events to clarify how the last ip address might appear?

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @VS0909,

You can try below;

rex "(?!.+\s\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Close, but your regex will match the first ip on the line, not the last one.

0 Karma

VS0909
Communicator

Can someone please help with the Splunk query for the below scenario:

I want to extract last IP address by a regular expression (regex) , for an event which has one or more IP addresses.

If the event has one IP ---> then extract that IP

If the event has more than one IP ---> then extract the last IP

Thanks!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...