Splunk Search

Rex Question

ho000dor
Explorer

Hi,

Does anyone know what i need to put in between these two fields in order to make the query continue on the ip2 if ip1 is found on a single log event? Sometimes there may not be an ip2... \s+ is what i have currently.

| rex "(?i)(?<ip1>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\s+(?<ip2>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
0 Karma
1 Solution

ho000dor
Explorer

That's exactly what i'm looking for! Thanks a lot!

View solution in original post

0 Karma

ho000dor
Explorer

That's exactly what i'm looking for! Thanks a lot!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

It'd be nice for future generations to accept the answer that solved the problem instead. Then others can immediately see the solution if they have similar questions rather than guessing what's the solution.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this (run anywhere sample, before rex part is to generate sample data)

|gentimes start=-1 | eval temp="192.168.1.1 4.2.2.2 blah blah other stuff #otherstuff 192.168.1.1 blah blah#otherstuff blah blah 192.168.1.1 blah blah 4.2.2.2 otherstuff" | table temp | makemv temp delim="#" | mvexpand temp | rename temp as _raw 
| rex "(?i)(?<ip1>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})(.*(?<ip2>(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}))|.*)"
0 Karma

ho000dor
Explorer

It could vary.

Anything from:

192.168.1.1 4.2.2.2 blah blah other stuff 

or 

otherstuff 192.168.1.1 blah blah

or 

otherstuff blah blah 192.168.1.1 blah blah 4.2.2.2 otherstuff

ip2 can be null if there isn't a second IP. Is that possible or do i have to set up a second | rex?

0 Karma

sk314
Builder

have you tried this rex max_match=2 field=_raw " (?i)(?\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})*" with max_match parameter set to 2 as mentioned in this http://answers.splunk.com/answers/47381/how-to-extract-all-matching-values-from-an-event-using-regex...

0 Karma

ho000dor
Explorer

Thanks a lot!

0 Karma

sk314
Builder

hodor

also sample data.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please post a sample of your data.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...