Basically, I have a multi value field where each value is a free form piece of text corresponding to dated text entries from a source application. These dated text entries can have a number of different IP Addresses, usernames, and domain names in them, all of which I'd like to eventually pull out into separate fields.
I've tried the idea below, but all I get is the first IP address that is found....
index="cases"
| rex field=evidence{}.text "(?<ioc>[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})"
If you just want ioc
to contain all IP addresses found in evidence{}.text
, just add this to your rex command: max_match=0
See: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex#Optional_arguments
If you want further help creating extractions for this data, you'd indeed need to share some sample data, otherwise people won't be able to help.
If you just want ioc
to contain all IP addresses found in evidence{}.text
, just add this to your rex command: max_match=0
See: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex#Optional_arguments
If you want further help creating extractions for this data, you'd indeed need to share some sample data, otherwise people won't be able to help.
This solved my problem!! Thanks!
I think that nobody will answer without presenting the sample log.
Agreed. @mumblingsages, why don't you provide a sample log file so that we can try the solution ourselves?