Splunk Search

What is the best way to pull out IP Addresses from a multivariate field?

mumblingsages
Path Finder

Basically, I have a multi value field where each value is a free form piece of text corresponding to dated text entries from a source application. These dated text entries can have a number of different IP Addresses, usernames, and domain names in them, all of which I'd like to eventually pull out into separate fields.

I've tried the idea below, but all I get is the first IP address that is found....

index="cases"
| rex field=evidence{}.text "(?<ioc>[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})"
0 Karma
1 Solution

FrankVl
Ultra Champion

If you just want ioc to contain all IP addresses found in evidence{}.text, just add this to your rex command: max_match=0
See: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex#Optional_arguments

If you want further help creating extractions for this data, you'd indeed need to share some sample data, otherwise people won't be able to help.

View solution in original post

0 Karma

FrankVl
Ultra Champion

If you just want ioc to contain all IP addresses found in evidence{}.text, just add this to your rex command: max_match=0
See: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex#Optional_arguments

If you want further help creating extractions for this data, you'd indeed need to share some sample data, otherwise people won't be able to help.

View solution in original post

0 Karma

mumblingsages
Path Finder

This solved my problem!! Thanks!

0 Karma

HiroshiSatoh
Champion

I think that nobody will answer without presenting the sample log.

pramit46
Contributor

Agreed. @mumblingsages, why don't you provide a sample log file so that we can try the solution ourselves?

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.