Rex Question

[ho000dor]

Hi,

Does anyone know what i need to put in between these two fields in order to make the query continue on the ip2 if ip1 is found on a single log event? Sometimes there may not be an ip2... \s+ is what i have currently.

| rex "(?i)(?<ip1>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+(?<ip2>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

[ho000dor · Accepted solution]

That's exactly what i'm looking for! Thanks a lot!

[martin_mueller]

It'd be nice for future generations to accept the answer that solved the problem instead. Then others can immediately see the solution if they have similar questions rather than guessing what's the solution.

[somesoni2]

Try this (run anywhere sample, before rex part is to generate sample data)

|gentimes start=-1 | eval temp="192.168.1.1 4.2.2.2 blah blah other stuff #otherstuff 192.168.1.1 blah blah#otherstuff blah blah 192.168.1.1 blah blah 4.2.2.2 otherstuff" | table temp | makemv temp delim="#" | mvexpand temp | rename temp as _raw 
| rex "(?i)(?<ip1>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})(.*(?<ip2>(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}))|.*)"

[ho000dor]

It could vary.

Anything from:

192.168.1.1 4.2.2.2 blah blah other stuff 

or 

otherstuff 192.168.1.1 blah blah

or 

otherstuff blah blah 192.168.1.1 blah blah 4.2.2.2 otherstuff

ip2 can be null if there isn't a second IP. Is that possible or do i have to set up a second | rex?

[sk314]

have you tried this rex max_match=2 field=_raw " (?i)(?\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})*" with max_match parameter set to 2 as mentioned in this http://answers.splunk.com/answers/47381/how-to-extract-all-matching-values-from-an-event-using-regex...

[ho000dor]

Thanks a lot!

[sk314]

hodor

also sample data.

[richgalloway]

Please post a sample of your data.