Hi all,
I have syslog data coming in - it features a src and dst IP address but how can I write a regex to select only the second IP address?
Only been doing regex for a week so any help is gratefully received 😆
Thanks
Mark
Write a regex that matches an IP address twice, but only include the second one in a matching group. Using the rex
command this regex should give you the IP address you want:
... | rex "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}.+?(?<ip_addr>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
Ah brilliant have done and award reputation points.
Thanks 😆
Mark
Not sure my interpretation was correct LOL
in the field extractor I amended the rex to look like this.
(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}.+?(?P
but I got
Invalid regex: no named extraction at position 0 (i.e., "(\d{1,3}...."). Expected "(?P
Looks like finally working like this 😆
rex "((?P
Cheers - you're an inspiration 😆
That's because you started off with a leading paranthesis which tells Splunk it should create a matching group, but you never assign a name to the group which is an error.
Anyway great if you got it working! Could you please mark my answer as accepted? Thanks!
Write a regex that matches an IP address twice, but only include the second one in a matching group. Using the rex
command this regex should give you the IP address you want:
... | rex "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}.+?(?<ip_addr>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"