Splunk Search

host_regex to determine IP address

wbfoxii
Communicator

I've got these logs from a number of sources that have inconsistent filenames - here are some examples:


AA000-77-100.100.100.100_abc__09348450.log
AA_000_100.200.100.100__abc__9038509485.log
100.210.100.100_abc__983475984759.log
AA000-110.200.100.110_abc__98234793437.log
AA0000-100.220.100.100_abc__9283492349.log

I'm using the following statement in the [monitor://] stanza, hoping to pull out the IP address for a host.

[monitor:///opt/splunk/var/log/test]
host_regex=.*[_-]+(?< host >\d+\.\d+\.\d+\.\d+)
(no spaces around "host", but it won't display unless I put them there)

That works for all of the names except the one that leads with the IP address. Any ideas about how I could make that one work? I was thinking that lookbehind might help, but I just don't understand regex that well.

Tags (1)
0 Karma
1 Solution

tgow
Splunk Employee
Splunk Employee

Here is the regex that I got to work with your data:

[-_]?(?<host>\d+\.\d+\.\d+\.\d+)_+\w+

Now let's analyze your regex and why it was not working. As a general rule you want to avoid using ".*" because it is too greedy. So I removed that and also I replaced the "+" with a "?". The "+" means 1 or more while the "?" means 0 or more because sometimes there isn't any dash or underscore in the name. Another general rule is to work backwards sometimes that is why I ended with an underscore "+" and a \w+.

Hope this helps.

View solution in original post

tgow
Splunk Employee
Splunk Employee

Here is the regex that I got to work with your data:

[-_]?(?<host>\d+\.\d+\.\d+\.\d+)_+\w+

Now let's analyze your regex and why it was not working. As a general rule you want to avoid using ".*" because it is too greedy. So I removed that and also I replaced the "+" with a "?". The "+" means 1 or more while the "?" means 0 or more because sometimes there isn't any dash or underscore in the name. Another general rule is to work backwards sometimes that is why I ended with an underscore "+" and a \w+.

Hope this helps.

wbfoxii
Communicator

That did it. Tested and I'm now pulling out the IP. Many thanks.

0 Karma

jonuwz
Influencer

"?" means 0 or 1 (greedily)

0 Karma