Solved: Re: How to edit my rex search to extract two diffe... - Splunk Community

Splunk Search

Current search:

search "xxx" | rex field=_raw "api:(?\s\d+.\d+.\d+.\d+)"

I'm using the rex command, but it does not return the expected result when there are two IP addresses.

1 Solution

Solution

If both IPs are in the same event with "api" before it, you can use max_match, like this

search "xxx" | rex max_match=0 field=_raw "api:\s?(?<IP>\d+.\d+.\d+.\d+)" | mvexpand IP | table IP

If they are not in the same event, will need to see some sample events.

http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Regex

View solution in original post

Solution

If both IPs are in the same event with "api" before it, you can use max_match, like this

search "xxx" | rex max_match=0 field=_raw "api:\s?(?<IP>\d+.\d+.\d+.\d+)" | mvexpand IP | table IP

If they are not in the same event, will need to see some sample events.

http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Regex

Please share some sample events.

---
If this reply helps you, Karma would be appreciated.

Get Updates on the Splunk Community!

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience, ...