SYSLOG - Regex Help needed - selecting second of two IP addresses.

[TheMarkHodgkins]

Hi all,

I have syslog data coming in - it features a src and dst IP address but how can I write a regex to select only the second IP address?

Only been doing regex for a week so any help is gratefully received 😆

Thanks

Mark

[TheMarkHodgkins]

Ah brilliant have done and award reputation points.

Thanks 😆

Mark

[TheMarkHodgkins]

Not sure my interpretation was correct LOL

in the field extractor I amended the rex to look like this.

(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}.+?(?P\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}))

but I got

Invalid regex: no named extraction at position 0 (i.e., "(\d{1,3}...."). Expected "(?Ppattern)"

Looks like finally working like this 😆

rex "((?P\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}).+?(?P\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}))"

Cheers - you're an inspiration 😆

[Ayn]

That's because you started off with a leading paranthesis which tells Splunk it should create a matching group, but you never assign a name to the group which is an error.

Anyway great if you got it working! Could you please mark my answer as accepted? Thanks!

[Ayn · Accepted solution]

Write a regex that matches an IP address twice, but only include the second one in a matching group. Using the rex command this regex should give you the IP address you want:

... | rex "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}.+?(?<ip_addr>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"