Splunk Search

use Rex to extract second IP address from message text

ikcresswell
Explorer

I am trying to extract the IP address from the field below, I can extract the first but am not sure how to extract the second. Field is as follows:

May 28 08:22:24 10.10.1.254 17361045: May 28 12:22:23.832: %FW-6-DROP_PKT: Dropping udp session 39.118.56.69:47069 10.10.1.179:43611 on zone-pair CSM_Outside-Inside_1 class class-default due to DROP action found in policy-map with ip ident 0

I use:
host=10.10.1.254 facility=FW mnemonic=DROP_PKT | rex field=_raw "session (?[^:]*)"
to extract the first IP (39.118.56.69) but am not sure how to extract the second (10.10.1.179), I would also like to extract the port numbers if possible.

Any help would be appreciated.

Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Assuming the first and second IP addresses are always separated by white space, this should work for you.

rex field=_raw "session (?<source_ip>[^:]*):((?<source_port>\d+)\s(?<second_ip>[^:]*):(?<second_port>\d+)"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

aholzer
Motivator

This should work for you:

rex field=_raw "session (?<source_ip>[^:]*?):([^\s]*?)\s(?<second_ip>[^:]*?):"

If you want to capture the ports as well. You can try this:

rex field=_raw "session (?<source_ip>[^:]*?):(?<source_port>[^\s]*?)\s(?<second_ip>[^:]*?):(?<second_port>[^\s]*?)\s"

Hope this helps.

0 Karma

theouhuios
Motivator

Try this

rex field=_raw "(?<IP_Address>\d+\.\d+\.\d+\.\d+)\:"
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Assuming the first and second IP addresses are always separated by white space, this should work for you.

rex field=_raw "session (?<source_ip>[^:]*):((?<source_port>\d+)\s(?<second_ip>[^:]*):(?<second_port>\d+)"
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...