Splunk Search

Need to extract IP Address

orchapellico
Explorer

I am very new to splunk and still learning, but have a need to get some IP addresses from a very large log file. Basically how the log file works is the IP address is at the end of the line and when that IP errors the following 2 lines in the log give some information on it. But I am needing to build a list of IP's that have errored. The log looks like this:

2012-05-23 00:00:56,578 [6792] INFO  Messaging.Common.LogUtil - UploadServer: Receiving SMail upload request from : 192.168.178.245
2012-05-23 00:00:56,578 [6792] ERROR Messaging.Common.LogUtil - UploadServer: File either not sent or length is invalid
2012-05-23 00:00:56,578 [6792] ERROR Messaging.Common.LogUtil - UploadServer: SMail message NOT stored - Returning error message: 2 - ERROR: File was not valid or no file was attempted to be sent

You notice there is a # in [ ] that is the same as the line that has the IP, this lets us know that this was the IP that had the error. I am not sure how to use these things to get me the list of IP's I need. Thank you for your help.

Tags (1)
1 Solution

araitz
Splunk Employee
Splunk Employee

Try this:

your search | rex "(?<src_ip>\d+\.\d+\.\d+\.\d+)" | rex "\s\[(?<tid>[^\]]+)\]" | transaction tid

The result should be all the events with the same transaction id (tid) grouped together with the src_ip field's value as the IP address in the first event.

View solution in original post

araitz
Splunk Employee
Splunk Employee

Try this:

your search | rex "(?<src_ip>\d+\.\d+\.\d+\.\d+)" | rex "\s\[(?<tid>[^\]]+)\]" | transaction tid

The result should be all the events with the same transaction id (tid) grouped together with the src_ip field's value as the IP address in the first event.

orchapellico
Explorer

Thank you araitz that worked great!

0 Karma

JSapienza
Contributor

If you are trying to pull this IP at search time the easiest thing is to do a simple field extraction.

More info here - InteractiveFieldExtractionExample

0 Karma

joneric_playstu
Engager

Could you please update this link?

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...