Splunk Search

Regex to match lines with multiple src_ip

saurabhkharkar
Path Finder

Hello, 

To pull in specific events in splunk i am trying to write a regex to identify lines that matches both the conditions

1: app_protocol=http or https

2. src_ip = starts with 15. or 16.

This is what i have , but doesnt seem to be working , am i doing somting wrong ? 

.*app_protocol=HTTP|S\s.*(src_ip\=15\.\d+\.\d+\.\d+|16.\.\d+\.\d+\.\d+)*
Labels (1)
0 Karma
1 Solution

hoaxm3
Path Finder

May want to paste in a raw log for testing, but you can give this a go:

(?i)app_protocol=https?.*?src_ip=(15|16)\.\d{1,3}\.\d{1,3}\.\d{1,3}

 

 

View solution in original post

0 Karma

hoaxm3
Path Finder

May want to paste in a raw log for testing, but you can give this a go:

(?i)app_protocol=https?.*?src_ip=(15|16)\.\d{1,3}\.\d{1,3}\.\d{1,3}

 

 

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...