Splunk Search

Regex to match lines with multiple src_ip

saurabhkharkar
Path Finder

Hello, 

To pull in specific events in splunk i am trying to write a regex to identify lines that matches both the conditions

1: app_protocol=http or https

2. src_ip = starts with 15. or 16.

This is what i have , but doesnt seem to be working , am i doing somting wrong ? 

.*app_protocol=HTTP|S\s.*(src_ip\=15\.\d+\.\d+\.\d+|16.\.\d+\.\d+\.\d+)*
Labels (1)
0 Karma
1 Solution

hoaxm3
Path Finder

May want to paste in a raw log for testing, but you can give this a go:

(?i)app_protocol=https?.*?src_ip=(15|16)\.\d{1,3}\.\d{1,3}\.\d{1,3}

 

 

View solution in original post

0 Karma

hoaxm3
Path Finder

May want to paste in a raw log for testing, but you can give this a go:

(?i)app_protocol=https?.*?src_ip=(15|16)\.\d{1,3}\.\d{1,3}\.\d{1,3}

 

 

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...