Solved: Required Regex

SabariRajanT · ‎08-03-2021

Hi Team,

I will be getting below text randomly in logs, I need a regex for the 1st IP's separately & 2nd IP's separately . can someone please help to get it.

The user Risen Paur ([email protected]) performed an impossible travel activity. The user was active from 117.202.23.200 in India and 173.205.24.222 in United States within 802 minutes.

@gcusello - Looking forward your help.

ITWhisperer · ‎08-03-2021

Assuming parts of the text are static

| rex "The user was active from (?<firstip>[\d\.]+) .+ and (?<secondip>[\d\.]+) "

View solution in original post

gcusello · ‎08-03-2021

HI @SabariRajanT,

the anser of @ITWhisperer is probably the correct one, to be sure, could you share some sample of your logs?

Ciao.

Giuseppe

ITWhisperer · ‎08-03-2021

Assuming parts of the text are static

| rex "The user was active from (?<firstip>[\d\.]+) .+ and (?<secondip>[\d\.]+) "

Required Regex

regex

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Splunk Enterprise Security: An Automated Phishing Response Workflow

Sharper ES Detections, Agentic AI Integrations, Smarter Workload Management, and More ...

Data Outage Monitoring and Reporting

Join the Conversation