Currently I have many logs in most of which there are random IPs.
1) I manage to achieve this like this:
index=ourindex | regex "(\b(?:(?:2(?:[0-4][0-9]|5[0-5])|[0-1]?[0-9]?[0-9])\.){3}(?:(?:2([0-4][0-9]|5[0-5])|[0-1]?[0-9]?[0-9]))\b)"
So now I have all events in which there are IPs, but how I should get these now and put them in a variable.
I guess I should use "eval" function or something else? Does macros will help here?
Any assistance will be much appreciated.
Hi tsvetan,
use rex command instead regex, e.g.:
index=ourindex
| rex "(?<IP_Address>\d+\.\d+\.\d+\.\d+)"
| table _time IP_Address
in this way (modifying the regex) you can store IP in the IP_Address field and use it.
Bye.
Giuseppe
Hi tsvetan,
use rex command instead regex, e.g.:
index=ourindex
| rex "(?<IP_Address>\d+\.\d+\.\d+\.\d+)"
| table _time IP_Address
in this way (modifying the regex) you can store IP in the IP_Address field and use it.
Bye.
Giuseppe
Wow thanks for the fast answer.