topic Re: Split IP Address in network and host part in Splunk Search

Split IP Address in network and host part

MOberschelp — Tue, 06 Feb 2018 09:37:51 GMT

Hi everyone,

I've got a little problem. I want to split up IP addresses in network and host part (to create a chart for network segments).

some search | rex field=scrip "(?<Net>.*\..*\.)(?<Host>.*)"

This is the rex part that I got so far. But there are no fields created with "Net" or "Host". What am I doing wrong?

Thanks for your help!

Regards,
Maik

Yunagi — Tue, 06 Feb 2018 14:17:57 GMT

What is the name of the field which contains the IP address? Is it really "scrip"? Perhaps there is a typo and it should be "srcip" or "src_ip".

I have modified your regex a little. Try it like this:

rex field=src_ip "(?<Net>\d+\.\d+\.\d+)\.(?<Host>\d+)"

I tested it like this which created a "Net" field and "Host" field:

| makeresults count=1 | eval src_ip="192.168.0.1" | rex field=src_ip "(?<Net>\d+\.\d+\.\d+)\.(?<Host>\d+)"

493669 — Tue, 06 Feb 2018 14:20:28 GMT

Hey,
It seems you have typo in your fieldname ... is your fieldname is scrip or script

micahkemp — Tue, 06 Feb 2018 14:43:52 GMT

Are you going to assume that every IP address belongs to a /24 network? That's not always a valid assumption.

MOberschelp — Tue, 06 Feb 2018 15:22:28 GMT

Omg! Please ignore this whole question...
We've checked it twice but didn't see that I had a typo. Of course the field is srcip and not scrip.

If I write it in the correct way it works fine... 😉

Thank you for your hint.

Regards,
Maik

MOberschelp — Tue, 06 Feb 2018 15:27:21 GMT

In this case... or for this case the ip address always belongs to class C network.