Search for unique IP's in splunk

Question

I've the splunk data something like:

{"@timestamp":"2019-02-26T05:12:30.090+00:00","@version":"1","message":"\n================>\nRequest Details:\n[requestId:abc118f2-qqff-10bb-a900-33cc9b88e333]\n[requestMethod = GET]\n[requestUrl = http://test.api.tmp.com/rawQuantities]\n[requestHeaders = {testing-id=Root=abc-123-xyz, x-forwarded-proto=https, host=test.api.tmp.com, x-forwarded-port=443, content-type=application/json, x-forwarded-for=xx.xx.xx.xx, accept-encoding=gzip,deflate, accept=application/json, user-agent=Apache-HttpClient/4.5.2 (Java/1.8.0_181)}]\n[requestBodySize: 0]\n<================>\n ... ... }

There is IP as: x-forwarded-for=xx.xx.xx.xx I just want to filter out all the unique IP's.

I've tried some combinations like:

index=api_dev sourcetype="test-api" message="*" | spath output=field path=_raw.requestDetails.x-forwarded-for

index=api_dev sourcetype="test-api" message=x-forwarded-for*

Answer 1

You can filter it out as follows:

index=test_dev sourcetype="test-api" | rex field=message "x-forwarded-for=(?P<client_ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | search test_ip="*"