host_regex to determine IP address

[wbfoxii]

I've got these logs from a number of sources that have inconsistent filenames - here are some examples:

AA000-77-100.100.100.100_abc__09348450.log

AA_000_100.200.100.100__abc__9038509485.log

100.210.100.100_abc__983475984759.log

AA000-110.200.100.110_abc__98234793437.log

AA0000-100.220.100.100_abc__9283492349.log

I'm using the following statement in the [monitor://] stanza, hoping to pull out the IP address for a host.

[monitor:///opt/splunk/var/log/test]

host_regex=.*[_-]+(?< host >\d+\.\d+\.\d+\.\d+)

(no spaces around "host", but it won't display unless I put them there)

That works for all of the names except the one that leads with the IP address. Any ideas about how I could make that one work? I was thinking that lookbehind might help, but I just don't understand regex that well.

[tgow · Accepted solution]

Here is the regex that I got to work with your data:

[-_]?(?<host>\d+\.\d+\.\d+\.\d+)_+\w+

Now let's analyze your regex and why it was not working. As a general rule you want to avoid using ".*" because it is too greedy. So I removed that and also I replaced the "+" with a "?". The "+" means 1 or more while the "?" means 0 or more because sometimes there isn't any dash or underscore in the name. Another general rule is to work backwards sometimes that is why I ended with an underscore "+" and a \w+.

Hope this helps.

[wbfoxii]

That did it. Tested and I'm now pulling out the IP. Many thanks.

[jonuwz]

"?" means 0 or 1 (greedily)