topic Re: How to create new field from a mv comma separated ip value field? in Splunk Search

How to create new field from a mv comma separated ip value field?

clozach — Wed, 30 Sep 2020 00:58:58 GMT

My IP field will come in as the following:

1.1.1.1,2.2.2.2

I need to extract the first IP and store it in another field (origin_ip) so that origin_ip's value is solely:

1.1.1.1

Thanks

richgalloway — Thu, 20 Jun 2019 17:07:01 GMT

There are a couple of ways to do that (possibly more)

... | rex field=ip "(?<origin_ip>[^,]+)" | ...

... | eval ips = split(ip, ",") | eval origin_ip = mvindex(ips, 0) | ...

woodcock — Thu, 20 Jun 2019 22:47:19 GMT

You can do this as a calculated field

| makeresults | eval ip="1.1.1.1,2.2.2.2"
| eval origin_ip=replace(ip,",.*$","")

jnudell_2 — Fri, 21 Jun 2019 15:52:25 GMT

You could try:

... search stuff ...

| eval origin_ip = mvindex(split(myipfield, ","), 0)

... search stuff ...

| eval origin_ip = replace(myipfield, ",.*", "")