Splunk Search

extract ip username

dbashyam
Explorer

Hi, I am trying to extract the following 

[04 May 2021 13:13:59,786] [Nsh-Proxy-Thread-93] [INFO] [abc@abc.com:abc:10.123.123.123] [BLSSOPROXY] Connected to sm478383922 with a socket descriptor 304

I want to extract the "[abc@abc.com:abc:10.123.123.123]" and destination "sm478383922" put it in a table form

UsernameGroupSrc IpDestination
abc@abc.comabc10.123.123.123sm478383922

 

can you guys help me how to achieve this in splunk search?

Labels (1)
Tags (1)
0 Karma
1 Solution

aasabatini
Motivator

Hi @dbashyam 

try this on your search

| rex field=_raw "(?<username>\w+@\w+.\w+):(?<group>\w+):(?<ip>\d+\.\d+.\d+.\d+)(?:[^:\n]*Connected){1}\s+\w+\s+(?<destination>\w+)"
“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”

View solution in original post

dbashyam
Explorer

Thanks you so much. It worked like a charm

0 Karma

aasabatini
Motivator

Hi @dbashyam 

try this on your search

| rex field=_raw "(?<username>\w+@\w+.\w+):(?<group>\w+):(?<ip>\d+\.\d+.\d+.\d+)(?:[^:\n]*Connected){1}\s+\w+\s+(?<destination>\w+)"
“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”

dbashyam
Explorer

@aasabatini  if I have any other string apart from "Connected", like copy, connecting, failed to connect etc., is there a way to add that condition? I tried the pipe symbol (for or) but it did not work

 

| rex field=_raw "(?<username>\w+@\w+.\w+):(?<group>\w+):(?<ip>\d+\.\d+.\d+.\d+)(?:[^:\n]*Connected){1}\s+\w+\s+(?<destination>\w+)"

 

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...