Splunk Search

Use regular expressions to search and filtering ip

jihoon
New Member

hi.

Add a tutorialdata.zip data and, if you type 'sourcetype = access_ *' searches

clientip = 91.205.189.15 ,182.236.164.11, 198.35.1.75 ...

Of these, only wants to get an IP address that begins with '91'.

Search sourcetype = access_* | rex "clientip=(?P\9d{1}.\d+.\d+).\d+"

However, all of the IP address is retrieved.

How can be modified to achieve the desired results?

Thanks

Tags (2)
0 Karma
1 Solution

pradeepkumarg
Influencer

Below should work if clientip is already extracted

sourcetype = access* clientip=91*

View solution in original post

pradeepkumarg
Influencer

Below should work if clientip is already extracted

sourcetype = access* clientip=91*

View solution in original post

Ayn
Legend

Yes, and even better would be to include the dot as well, so

sourcetype=access_* clientip=91.*

This will enable Splunk to find all unique events that include the string "91" so it only needs to retrieve those from disk.

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.