I'm trying to throw out search results from a couple of different ip ranges. Currently I'm working with 2, but I might end up with three or more. Anywhoo, regex A looks like "XY.\d{1,3}.\d{1,3}.\d{1,3}" and regex B looks like "XYZ.AB.\d{1,3}.\d{1,3}"
I want one regex to match both. I thought that doing "XY.\d{1,3}.\d{1,3}.\d{1,3}|XYZ.AB.\d{1,3}.\d{1,3}" would do it, but it's not.
I've not had much luck finding help online, maybe you guys can help?
You may also want to look using into the where
command with the cidrmatch()
function:
http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/CommonEvalFunctions
There's also something I noticed if you're performing the search on SplunkWEB, the search tends to become slow when you're searching regex from raw log files, than searching indexed fields.
Try this:
(XY.\d{1,3}|XYZ.AB).\d{1,3}.\d{1,3}
thanks, that did the trick.