$ipaddr (parse-spec) function


The IPv4 portion of the word given by parse-spec is returned. This function returns the text delimited by the first punctuation or space following the address, if any. If the parse-spec value does not return an IP address, the match specification is not matched. This function is especially useful in a nested specification. (See further section.)

Target string

Parse expression

Return value

src: 192.168.1.1 dest: 10.1.1.2

$ipaddr ($2)

192.168.1.1

address tgt: 1.2.1.1:88 logged


$ipaddr (tgt: *)

1.2.1.1

Warning

Note

The port number is not is returned.

drop=66.2.3.45

$ipaddr (drop=*)

66.2.3.45

POST https://1.2.3.4:88

$ipaddr( post *)

No match. The matched text is not an IPv4 address.

Test 123

$ipaddr ($2)

No match. The second word of the target string is not an IPv4 address.

Test string AAA

$ipaddr ($4)

No match. There is no fourth word in the string. 

Test 192.1.1.1 value

$ipaddr (xxx: *)

No match. There is no match for XXX: * in the target string.

Related topic


 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*

BMC Defender SIEM Correlation Server 5.9