topic Re: rex to create two new fields from a single field in Splunk Search

How to create two new fields from a single field?

bt149 — Fri, 24 Mar 2023 14:13:49 GMT

I have a log set from FW's. These logs have a field called "src." From what I can tell, this field is populated with values such as:
FQDN (myhost.mydomain.com)
Console or telnet
10.0.0.1

I'm looking to have two fields created from the "src" field, one name IP if the value in "src" is an IP and "src_nt_host" if the value is not an ip_address. A small sample from the logged event:

From: Console or telnet.
From: myhost.mydomain.com.
From: 10.0.0.1.

Any help / guidance is greatly appreciated.

Re: rex to create two new fields from a single field

gcusello — Fri, 24 Mar 2023 13:41:15 GMT

Hi @bt149 ,

you could try something like this:

<your_search> | rex field=src "(?<ip>\d+\.\d+\.\d+\.\d+)" | eval src_nt_host=if(isempty(ip),src,"") | ...

Ciao.

Giuseppe

Re: How to create two new fields from a single field?

bt149 — Fri, 24 Mar 2023 14:25:48 GMT

Thank you but that didn't do the trick.

Re: How to create two new fields from a single field?

gcusello — Sat, 25 Mar 2023 06:32:30 GMT

HI @bt149 ,

Sorry, please try this:

<your_search> | rex field=src "(?<ip>\d+\.\d+\.\d+\.\d+)" | eval src_nt_host=if(isnull(ip),src,"")

that I tested

Ciao.

Giuseppe

Re: How to create two new fields from a single field?

bt149 — Sat, 25 Mar 2023 12:02:14 GMT

Thank you Giuseppe! This worked well.