Getting Data In

extracting ip details from apache logs

adriangoodhead7
Explorer

Hi all, i'm new to splunk. I've managed to get it set up and imported a load of Apache log files. When I search by host, it shows all the logs but I can't quite work out the next step.

Ultimately I would like to produce a chart/graph of the number of times an ip address appers in the events, and splunk has correctly identified the date/time stamp, and sorted accordingly. I can see the ip addresses in the event (, but can't work out how to get the data into a graph format.

There doesn't seem to be a IP address field, how do I use splunk to extract the IP addresses from the logs?

I'm sure this is quite a basic thing to do, i'll continue my research online.

Thanks.

Tags (2)
0 Karma
1 Solution

adriangoodhead7
Explorer

I changed the source type to "access_combined" and now its sorted, thanks 😉

View solution in original post

adriangoodhead7
Explorer

I changed the source type to "access_combined" and now its sorted, thanks 😉

somesoni2
SplunkTrust
SplunkTrust

You can include following in your search to extract the IP address at search time and use this field in your charting search.

your base search| rex  "(?<IP_address>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | your chart search using field IP_address
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Take a look at the search tutorial: http://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/WelcometotheSearchTutorial

These kinds of questions are answered and explained there, even using access logs as an example.

0 Karma

adriangoodhead7
Explorer

Here is an entry from splunk

65.55.52.111 - - [18/Nov/2013:20:50:42 -0700] "GET acme.com/~fb872661/ HTTP/1.1" 200 6374 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)" 0 "redirect-handler" "/var/chroot/home/content/20/11043820/html/index.php" 228881
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...