requests that starts with certain ips

[xvxt006]

Hi,

i wanted to get times only for clietips that starts with certain ips. So i have this query below. This is not giving any data. When i have clientip="^(?:10..+|167.115..+|192.168..+|63.85.50.241)"
then it works (requests that does not start with those ips).
Can someone tell me what is wrong with this?

sourcetype=access_combined_wcookie host="xxxx*" regex clientip="^(?:10..+|16.115..+|199.168..+|63.12.23.241)" TimeInSecs> "1" AND TimeInSecs <= "1.5" | timechart count(uri) as "1-1.5"

[Ayn · Accepted solution]

I'm pretty sure your first example should not work at all if you put that as a filter string for the search command. search does not support regexes.

What your search string at the end does is it tries to find events with the STRING "regex" and values for the field "clientip" that are actually literally the string " (?:10..+ [...]" (and so on).

I think you're doing this a bit more complicated than it needs to be. Just doing something like this would work:

sourcetype=access_combined_wcookie host="xxxx*" (clientip="10.*" OR clientip="16.115.*" OR clientip="199.168.*" OR clientip="63.12.23.241") TimeInSecs> "1" AND TimeInSecs <= "1.5" | timechart count(uri) as "1-1.5"

[Ayn]

Nope, * is just a character functioning as a wildcard in the search command. Regular expressions cannot be used directly in the search command - if you would want to filter by regular expression for one reason or another you would have to use the regex command further along the search pipeline.

[xvxt006]

Hi Ayn, Thanks for your reply. Actually i was using the way you suggested and thought of using regex. I am wondering how this is working - clientip="^(?:10..+|167.115..+|192.168..+|63.85.50.241)" (which gives ips does not start with those).
You said search does not support regex. when we have query like this clientip="10." OR clientip="16.115.", i am thinking * is regex right?