topic Re: How break out user and ip from a single field in Splunk Search

How break out user and ip from a single field

omgwut56k — Thu, 18 Aug 2016 14:52:30 GMT

My data for field entity contains either a username or an ip address.

How can make a new field for either user or src_ip?

for example

entity=rhoward
entity=10.0.0.1
entity=192.168.1.1
entity=jbozo

I would like a new field for user and src_ip

Thank you!

Re: How break out user and ip from a single field

richgalloway — Thu, 18 Aug 2016 14:55:45 GMT

This is a job for coalesce.

... | eval newField=coalesce(user, src_ip) | ...

Re: How break out user and ip from a single field

omgwut56k — Thu, 18 Aug 2016 14:59:58 GMT

Thank you. However if the field has an ip address I would like that to be expressed src_ip, if it's a user I would like it expressed as user.. Is that possible?

Re: How break out user and ip from a single field

gfuente — Thu, 18 Aug 2016 15:13:31 GMT

Hello

You could create two new fields from the entity one, like:

| eval user=if(match(entity, "[a-zA-Z]+"), entity, null) | eval src_ip=if(match(entity, "^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$"), entity, null)

Regards

Re: How break out user and ip from a single field

gfuente — Fri, 19 Aug 2016 06:37:52 GMT

Thanks for the points omgwut56k. If you feel the solution works, please mark it as solved. thanks

Re: How break out user and ip from a single field

omgwut56k — Fri, 19 Aug 2016 13:18:34 GMT

I 'accepted' the answer. Not sure where here to mark it as solved.

Re: How break out user and ip from a single field

nnmiller — Fri, 19 Aug 2016 13:28:01 GMT

"Accepted" == solved.