Splunk Search

What is the best way to pull out IP Addresses from a multivariate field?

Path Finder

Basically, I have a multi value field where each value is a free form piece of text corresponding to dated text entries from a source application. These dated text entries can have a number of different IP Addresses, usernames, and domain names in them, all of which I'd like to eventually pull out into separate fields.

I've tried the idea below, but all I get is the first IP address that is found....

index="cases"
| rex field=evidence{}.text "(?<ioc>[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})"
0 Karma
1 Solution

Ultra Champion

If you just want ioc to contain all IP addresses found in evidence{}.text, just add this to your rex command: max_match=0
See: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex#Optional_arguments

If you want further help creating extractions for this data, you'd indeed need to share some sample data, otherwise people won't be able to help.

View solution in original post

0 Karma

Ultra Champion

If you just want ioc to contain all IP addresses found in evidence{}.text, just add this to your rex command: max_match=0
See: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex#Optional_arguments

If you want further help creating extractions for this data, you'd indeed need to share some sample data, otherwise people won't be able to help.

View solution in original post

0 Karma

Path Finder

This solved my problem!! Thanks!

0 Karma

Champion

I think that nobody will answer without presenting the sample log.

Contributor

Agreed. @mumblingsages, why don't you provide a sample log file so that we can try the solution ourselves?

0 Karma