Splunk Search

Tricky regex

dbcase
Motivator

Hi,

I have this data
"166.78.66.241" 70.121.107.109 "70.121.107.109" - - [19/Jan/2018:12:24:33 -0600] "POST /fileUpload/image HTTP/1.1" 200 - 137895 214 UCT-556540 "-" "-" "-"

10.210.192.15 - - [19/Jan/2018:11:00:22 -0500] "POST /fileUpload/image HTTP/1.1" 200 - "-" "-"

27.127.175.202, 192.168.10.101 - - [19/Jan/2018:08:59:53 +0900] "POST /fileUpload/image HTTP/1.1" 200 - "-" "-"

and I need to extract out the IP addresses

The first line IP address would be 70.121.107.109
The second line IP address would be 10.210.192.15
and the third line would be 27.127.175.202

I've tried and failed several times to figure out how to get 1 regex expression
to do this

any thoughts?

Tags (2)
0 Karma
1 Solution

micahkemp
Champion

It looks like you want the first non-quotes IP address, which should be doable with this:

https://regex101.com/r/Kv2miD/1

(?<ip>(?:[0-9]{1,3}\.){3}[0-9]{1,3})[\s,]

That just looks for something that looks like an IP address followed immediately by a whitespace or comma.

View solution in original post

0 Karma

micahkemp
Champion

It looks like you want the first non-quotes IP address, which should be doable with this:

https://regex101.com/r/Kv2miD/1

(?<ip>(?:[0-9]{1,3}\.){3}[0-9]{1,3})[\s,]

That just looks for something that looks like an IP address followed immediately by a whitespace or comma.

0 Karma

dbcase
Motivator

Wow, just wow.... One day I want to grow up and do regex like that! 🙂

Many thanks!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...