my ($srcip) = $whole_event_string =~ /^(\d+\.\d+\.\d+\.\d+)/;