Splunk Search

Regex for multiple IP Addresses in Splunk

asplunk123
New Member

In the below log we have User Agent fallowed by two Ip addresses. So i want to extract below fields

UserAgent , IPAdd2, IPAdd2

My Regex : (getting error)

rex (?.[a-zA-Z0-9-/^%?;.\s\w&()=-]+) | rex "^(?i)(?P[^ ,]+)(,(?P[^ ,]+))?"

Log :

"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:32.0) Gecko/20100101 Firefox/28.0" "158.69.213.225, 23.217.200.191"

Tags (1)
0 Karma

woodcock
Esteemed Legend

This will create a mult-valued field:

... | rex max_match=0 "(?<IPAddress>\d+\.\d+\.\d+\.\d+)"

You can use a more specific RegEx if you like, but the more complicated it is, the slower it will be, too, and simpler ones are unlikely to have false positives.

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...