Splunk Search

host_regex to determine IP address

wbfoxii
Communicator

I've got these logs from a number of sources that have inconsistent filenames - here are some examples:


AA000-77-100.100.100.100_abc__09348450.log
AA_000_100.200.100.100__abc__9038509485.log
100.210.100.100_abc__983475984759.log
AA000-110.200.100.110_abc__98234793437.log
AA0000-100.220.100.100_abc__9283492349.log

I'm using the following statement in the [monitor://] stanza, hoping to pull out the IP address for a host.

[monitor:///opt/splunk/var/log/test]
host_regex=.*[_-]+(?< host >\d+\.\d+\.\d+\.\d+)
(no spaces around "host", but it won't display unless I put them there)

That works for all of the names except the one that leads with the IP address. Any ideas about how I could make that one work? I was thinking that lookbehind might help, but I just don't understand regex that well.

Tags (1)
0 Karma
1 Solution

tgow
Splunk Employee
Splunk Employee

Here is the regex that I got to work with your data:

[-_]?(?<host>\d+\.\d+\.\d+\.\d+)_+\w+

Now let's analyze your regex and why it was not working. As a general rule you want to avoid using ".*" because it is too greedy. So I removed that and also I replaced the "+" with a "?". The "+" means 1 or more while the "?" means 0 or more because sometimes there isn't any dash or underscore in the name. Another general rule is to work backwards sometimes that is why I ended with an underscore "+" and a \w+.

Hope this helps.

View solution in original post

tgow
Splunk Employee
Splunk Employee

Here is the regex that I got to work with your data:

[-_]?(?<host>\d+\.\d+\.\d+\.\d+)_+\w+

Now let's analyze your regex and why it was not working. As a general rule you want to avoid using ".*" because it is too greedy. So I removed that and also I replaced the "+" with a "?". The "+" means 1 or more while the "?" means 0 or more because sometimes there isn't any dash or underscore in the name. Another general rule is to work backwards sometimes that is why I ended with an underscore "+" and a \w+.

Hope this helps.

wbfoxii
Communicator

That did it. Tested and I'm now pulling out the IP. Many thanks.

0 Karma

jonuwz
Influencer

"?" means 0 or 1 (greedily)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...