topic Re: How do i search for IPv6 addresses from my src_ip field. in Splunk Search

How do i search for IPv6 addresses from my src_ip field.

cesaccenturefed — Fri, 14 Aug 2015 21:17:18 GMT

I'm trying to do a search that finds IPv6 addresses. Currently our field src_ip has both IPv4 and IPv6 in it. How can i search so only events with IPv6 addresses are returned?

Re: How do i search for IPv6 addresses from my src_ip field.

lloydd518 — Tue, 29 Sep 2020 07:00:33 GMT

This is a bit quick and dirty but...

sourcetype=your_sourcetype src_ip=":"

Re: How do i search for IPv6 addresses from my src_ip field.

cesaccenturefed — Thu, 27 Aug 2015 21:51:24 GMT

I feel as though I should slap myself in the face for not figuring this out on my own! just tried it and it worked. did this src_ip=":"

Re: How do i search for IPv6 addresses from my src_ip field.

diablojohn — Tue, 05 Feb 2019 18:43:44 GMT

this is the most simplest way i came up with.

| regex src_ip!="(^[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}$)"

this will remove all IPv4 addresses from your search.

Re: How do i search for IPv6 addresses from my src_ip field.

diablojohn — Tue, 29 Sep 2020 23:09:54 GMT

This is the simplest way i could come up with.

| regex src_ip!="(^[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}.[0-9]{1,3}$)"

This will remove all IPv4 addresses from your search. don't forget to switch "src_ip" to what field you are searching. (e,g, dest_ip, rx_hosts, tx_hosts)

Re: How do i search for IPv6 addresses from my src_ip field.

bigll — Tue, 29 Jun 2021 16:45:19 GMT

One that works for me

src_ip="*:*"