Splunk Search

Required Regex

SabariRajanT
Path Finder

Hi Team,

I will be getting below text randomly in logs, I need a regex for the 1st IP's separately & 2nd IP's separately . can someone please help to get it.

The user Risen Paur (risen.paur@mail.eeir) performed an impossible travel activity. The user was active from 117.202.23.200 in India and 173.205.24.222 in United States within 802 minutes.

@gcusello - Looking forward your help.

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Assuming parts of the text are static

| rex "The user was active from (?<firstip>[\d\.]+) .+ and (?<secondip>[\d\.]+) "

View solution in original post

gcusello
SplunkTrust
SplunkTrust

HI @SabariRajanT,

the anser of @ITWhisperer is probably the correct one, to be sure, could you share some sample of your logs?

Ciao.

Giuseppe

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming parts of the text are static

| rex "The user was active from (?<firstip>[\d\.]+) .+ and (?<secondip>[\d\.]+) "
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...