Solved: Required Regex

SabariRajanT · ‎08-03-2021

Hi Team,

I will be getting below text randomly in logs, I need a regex for the 1st IP's separately & 2nd IP's separately . can someone please help to get it.

The user Risen Paur (risen.paur@mail.eeir) performed an impossible travel activity. The user was active from 117.202.23.200 in India and 173.205.24.222 in United States within 802 minutes.

@gcusello - Looking forward your help.

ITWhisperer · ‎08-03-2021

Assuming parts of the text are static

| rex "The user was active from (?<firstip>[\d\.]+) .+ and (?<secondip>[\d\.]+) "

View solution in original post

gcusello · ‎08-03-2021

HI @SabariRajanT,

the anser of @ITWhisperer is probably the correct one, to be sure, could you share some sample of your logs?

Ciao.

Giuseppe

ITWhisperer · ‎08-03-2021

Assuming parts of the text are static

| rex "The user was active from (?<firstip>[\d\.]+) .+ and (?<secondip>[\d\.]+) "

Required Regex

regex

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

Your summer travels continue with new course releases

Are you a member of the Splunk Community?

Required Regex

regex

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

Your summer travels continue with new course releases