Please enable JavaScript to use regex101
/
^
r
e
g
e
x
[
\
-
_
]
?
1
0
1
$
/
i
Reg
ular
Ex
pressions
101
Reg
ular
Ex
pressions
101
Upgrade to Pro
Enterprise
Regular Expression
/
SrcIP:\s(?<SrcIP>(.*?))(,|\z)
/
gm
Input 1
1
New
May 4 13:37:50 abcd fdf: Protocol: TCP, SrcIP: 111.111.111.12, OriginalClientIP: ::, DstIP: 110.112.113.114, SrcPort: 56896, DstPort: 80, TCPFlags: 0x0, IngressZone: INSIDE, EgressZone: OUTSIDE, DE: Primary Detection Engine (dsdsdasdsda), Policy: C_POLICY, ConnectType: Start, AccessControlRuleName: inside to outside, AccessControlRuleAction: Allow, Prefilter Policy: r_Prefilter, UserName: No Authentication Required, UserAgent: Mozilla/5.0 (compatible; MSIE 8.0;), Client: Internet Explorer, ClientVersion: 8.0, ApplicationProtocol: HTTP, InitiatorPackets: 3, ResponderPackets: 1, InitiatorBytes: 394, ResponderBytes: 66, NAPPolicy: Balanced Security and Connectivity, DNSResponseType: No Error, Sinkhole: Unknown, ReferencedHost: splunk.com, URLCategory: Business and Economy, URLReputation: Well known, URL: http://splunk.com/
Extraction