Splunk Search

field extraction regex

EricPartington
Communicator

THis might be a bit difficult, but i want to try anyways... I am trying to aggrgate source and destination IP addresses across a few different device types. For all device types the src and dest ip addresses are valid IPV4 but one type can show Ip addresses in two formats.

192.168.1.1
or HOSTNAME1_192.168.1.2

the field looks like this when i want to extract it

src=192.168.1.1
or 
src=HOSTNAME1_192.168.1.2

in the lea-loggrabber-splunk/local/transforms.conf the kv extraction looks like this in this

[src_ip]
SOURCE_KEY=src
REGEX=(.*)
FORMAT=src_ip::$1

which means that I am trying to aggregate IPs that may or may not match.

Two part question: Is there a way to write a regex that will grab only the IP part from the string (either following the = or _ if the ip starts with HOSTNAME1_192.168.1.2)?

would the best way be to define a new field value for just the IP and one for the hostname HOSTNAME1_192.168.1.2 ->(hostname::$1)_(ip::$2)

secondly would this be best approached by a seperate transforms stanza and props.conf entry (REPORT-ip-extact = ) for the sourcetype([opsec])?

0 Karma
1 Solution

Ledion_Bitincka
Splunk Employee
Splunk Employee

Try the following

[extract_hostnum_ip]
SOURCE_KEY=src
REGEX=(?:HOSTNAME(?<hostnum>\d+)_)?(?<ip>\d+\.\d+\.\d+\.\d+)

View solution in original post

Ledion_Bitincka
Splunk Employee
Splunk Employee

Try the following

[extract_hostnum_ip]
SOURCE_KEY=src
REGEX=(?:HOSTNAME(?<hostnum>\d+)_)?(?<ip>\d+\.\d+\.\d+\.\d+)

EricPartington
Communicator

would that line be added to props or transforms? My guess is props.conf

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...