https://community.splunk.com/t5/Splunk-Search/How-to-search-and-extract-the-correct-value-from-duplicate-keys/m-p/110748#M28966 <P>Self-answer: use search time field extraction: (?i) ip="(?P<REALIP>[^"]+)" timestamp</REALIP></P> Thu, 04 Sep 2014 08:52:19 GMT konrads 2014-09-04T08:52:19Z https://community.splunk.com/t5/Splunk-Search/How-to-search-and-extract-the-correct-value-from-duplicate-keys/m-p/110746#M28964 <P>Hello,<BR /> I have a lot of events indexed which contain the following line:<BR /> |ip="0.0.0.0" foo="bar" ip="174.34.166.10" timestamp="2014-08-18 06:30:33 UTC"</P> <P>The first "ip" value is "wrong" value and the second should be used only. How do I search/extract the second ip value and discard the first?</P> Thu, 04 Sep 2014 08:30:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-and-extract-the-correct-value-from-duplicate-keys/m-p/110746#M28964 konrads 2014-09-04T08:30:53Z https://community.splunk.com/t5/Splunk-Search/How-to-search-and-extract-the-correct-value-from-duplicate-keys/m-p/110747#M28965 <P>Assuming your "0.0.0.0" is that "wrong" value you want to avoid (and that's not just a placeholder you put in here), why not try using a regex to match IP addresses that aren't 0.0.0.0? </P> <P>Even if 0.0.0.0 isn't actually the value that you're trying to avoid, a regex could probably help you extract the second address, anyway. </P> <P>The docs for spunk's regex function even include a couple of ip-address matching examples you might be able to adapt: <A href="http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/regex">http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/regex</A></P> Thu, 04 Sep 2014 08:51:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-and-extract-the-correct-value-from-duplicate-keys/m-p/110747#M28965 petecooper 2014-09-04T08:51:40Z https://community.splunk.com/t5/Splunk-Search/How-to-search-and-extract-the-correct-value-from-duplicate-keys/m-p/110748#M28966 <P>Self-answer: use search time field extraction: (?i) ip="(?P<REALIP>[^"]+)" timestamp</REALIP></P> Thu, 04 Sep 2014 08:52:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-and-extract-the-correct-value-from-duplicate-keys/m-p/110748#M28966 konrads 2014-09-04T08:52:19Z https://community.splunk.com/t5/Splunk-Search/How-to-search-and-extract-the-correct-value-from-duplicate-keys/m-p/110749#M28967 <P>if I'd do that, then where I have ip="0.0.0.0" ... ip="1.2.3.4" lines won't match at all. Field extraction was the way to go, but thanks for your suggestion.</P> Thu, 04 Sep 2014 08:53:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-and-extract-the-correct-value-from-duplicate-keys/m-p/110749#M28967 konrads 2014-09-04T08:53:28Z