What is the best way to pull out IP Addresses from a multivariate field?

[mumblingsages]

Basically, I have a multi value field where each value is a free form piece of text corresponding to dated text entries from a source application. These dated text entries can have a number of different IP Addresses, usernames, and domain names in them, all of which I'd like to eventually pull out into separate fields.

I've tried the idea below, but all I get is the first IP address that is found....

index="cases"
| rex field=evidence{}.text "(?<ioc>[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})"

[FrankVl · Accepted solution]

If you just want ioc to contain all IP addresses found in evidence{}.text, just add this to your rex command: max_match=0
See: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Rex#Optional_arguments

If you want further help creating extractions for this data, you'd indeed need to share some sample data, otherwise people won't be able to help.

[mumblingsages]

This solved my problem!! Thanks!

[HiroshiSatoh]

I think that nobody will answer without presenting the sample log.

[pramit46]

Agreed. @mumblingsages, why don't you provide a sample log file so that we can try the solution ourselves?