Splunk Search
Highlighted

Use regular expressions to search and filtering ip

New Member

hi.

Add a tutorialdata.zip data and, if you type 'sourcetype = access_ *' searches

clientip = 91.205.189.15 ,182.236.164.11, 198.35.1.75 ...

Of these, only wants to get an IP address that begins with '91'.

Search sourcetype = access_* | rex "clientip=(?P\9d{1}.\d+.\d+).\d+"

However, all of the IP address is retrieved.

How can be modified to achieve the desired results?

Thanks

Tags (2)
0 Karma
Highlighted

Re: Use regular expressions to search and filtering ip

Influencer

Below should work if clientip is already extracted

sourcetype = access* clientip=91*

View solution in original post

Highlighted

Re: Use regular expressions to search and filtering ip

Legend

Yes, and even better would be to include the dot as well, so

sourcetype=access_* clientip=91.*

This will enable Splunk to find all unique events that include the string "91" so it only needs to retrieve those from disk.