Splunk Search

What is the best way to pull out IP Addresses from a multivariate field?

mumblingsages
Path Finder

Basically, I have a multi value field where each value is a free form piece of text corresponding to dated text entries from a source application. These dated text entries can have a number of different IP Addresses, usernames, and domain names in them, all of which I'd like to eventually pull out into separate fields.

I've tried the idea below, but all I get is the first IP address that is found....

index="cases"
| rex field=evidence{}.text "(?<ioc>[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})"
0 Karma
1 Solution

FrankVl
Ultra Champion

If you just want ioc to contain all IP addresses found in evidence{}.text, just add this to your rex command: max_match=0
See: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex#Optional_arguments

If you want further help creating extractions for this data, you'd indeed need to share some sample data, otherwise people won't be able to help.

View solution in original post

0 Karma

FrankVl
Ultra Champion

If you just want ioc to contain all IP addresses found in evidence{}.text, just add this to your rex command: max_match=0
See: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex#Optional_arguments

If you want further help creating extractions for this data, you'd indeed need to share some sample data, otherwise people won't be able to help.

0 Karma

mumblingsages
Path Finder

This solved my problem!! Thanks!

0 Karma

HiroshiSatoh
Champion

I think that nobody will answer without presenting the sample log.

pramit46
Contributor

Agreed. @mumblingsages, why don't you provide a sample log file so that we can try the solution ourselves?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...