Splunk Search

Need a rex to extract an ip address with a trailing port number

mark_groenveld
Path Finder

I would like to extract an ip address from a text field where the ip address has a trailing port number.

The text is like so:  X-Upstream:"11.111.11.11:81"

The extraction would provide only the ip address.

Thanks.

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})(?=:\d+)"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| rex "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})(?=:\d+)"

PickleRick
SplunkTrust
SplunkTrust

If I were to be nitpicky I'd say that it captures stuff like 000.999.123.987, which is not a valid IP 😉

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

True, but I didn't want to give away all my secrets! 😎😁

0 Karma

PickleRick
SplunkTrust
SplunkTrust

😁

But seriously, this solution is usually good enough unless you have a strict demand on validating the IP format in which case regex is not the best tool for the job (it can be done using regex but it's neither pretty, nor efficient).

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

We have used it in RegexGames although I can't remember how many came up with a solution. Yes, regex may not be "pretty", but can be fun trying to solve regex puzzles!

0 Karma
Get Updates on the Splunk Community!

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco &#43; Splunk! We’ve ...

Enterprise Security Content Update (ESCU) | New Releases

In April, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security ...

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...
OSZAR »