Splunk Search

SYSLOG - Regex Help needed - selecting second of two IP addresses.

TheMarkHodgkins
Explorer

Hi all,

I have syslog data coming in - it features a src and dst IP address but how can I write a regex to select only the second IP address?

Only been doing regex for a week so any help is gratefully received 😆

Thanks

Mark

Tags (1)
1 Solution

Ayn
Legend

Write a regex that matches an IP address twice, but only include the second one in a matching group. Using the rex command this regex should give you the IP address you want:

... | rex "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}.+?(?<ip_addr>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

View solution in original post

TheMarkHodgkins
Explorer

Ah brilliant have done and award reputation points.

Thanks 😆

Mark

TheMarkHodgkins
Explorer

Not sure my interpretation was correct LOL

in the field extractor I amended the rex to look like this.

(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}.+?(?P\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}))

but I got

Invalid regex: no named extraction at position 0 (i.e., "(\d{1,3}...."). Expected "(?Ppattern)"

Looks like finally working like this 😆

rex "((?P\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}).+?(?P\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}))"

Cheers - you're an inspiration 😆

Ayn
Legend

That's because you started off with a leading paranthesis which tells Splunk it should create a matching group, but you never assign a name to the group which is an error.

Anyway great if you got it working! Could you please mark my answer as accepted? Thanks!

Ayn
Legend

Write a regex that matches an IP address twice, but only include the second one in a matching group. Using the rex command this regex should give you the IP address you want:

... | rex "\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}.+?(?<ip_addr>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...