Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Tricky regex
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I have this data
"166.78.66.241" 70.121.107.109 "70.121.107.109" - - [19/Jan/2018:12:24:33 -0600] "POST /fileUpload/image HTTP/1.1" 200 - 137895 214 UCT-556540 "-" "-" "-"
10.210.192.15 - - [19/Jan/2018:11:00:22 -0500] "POST /fileUpload/image HTTP/1.1" 200 - "-" "-"
27.127.175.202, 192.168.10.101 - - [19/Jan/2018:08:59:53 +0900] "POST /fileUpload/image HTTP/1.1" 200 - "-" "-"
and I need to extract out the IP addresses
The first line IP address would be 70.121.107.109
The second line IP address would be 10.210.192.15
and the third line would be 27.127.175.202
I've tried and failed several times to figure out how to get 1 regex expression
to do this
any thoughts?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It looks like you want the first non-quotes IP address, which should be doable with this:
https://regex101.com/r/Kv2miD/1
(?<ip>(?:[0-9]{1,3}\.){3}[0-9]{1,3})[\s,]
That just looks for something that looks like an IP address followed immediately by a whitespace or comma.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It looks like you want the first non-quotes IP address, which should be doable with this:
https://regex101.com/r/Kv2miD/1
(?<ip>(?:[0-9]{1,3}\.){3}[0-9]{1,3})[\s,]
That just looks for something that looks like an IP address followed immediately by a whitespace or comma.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Wow, just wow.... One day I want to grow up and do regex like that! 🙂
Many thanks!!
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
