https://community.splunk.com/t5/Splunk-Search/Splitting-field-into-2-fields/m-p/190507#M54862 <P>Do you realize that <CODE>coalesce</CODE> does not really "combine" your IPs? In any case, This should do it:</P> <PRE><CODE>... | rex field=combined_ip "^(?&lt;combined_ipv4&gt;\d+\.\d+\.\d+\.\d+)|(?&lt;combined_ipv6&gt;.*)$" </CODE></PRE> Fri, 03 Jul 2015 03:09:37 GMT woodcock 2015-07-03T03:09:37Z https://community.splunk.com/t5/Splunk-Search/Splitting-field-into-2-fields/m-p/190506#M54861 <P>I have a list of IP addresses that I get from a <CODE>eval combined_ip = coalesce(src_ip, dst_ip)</CODE> command. This list combined_ips contains both IPv4 and IPv6 addresses and I would like to separate them into two new fields ipv4 and ipv6?</P> <P>How do would I create these two new fields?</P> Fri, 03 Jul 2015 02:15:29 GMT https://community.splunk.com/t5/Splunk-Search/Splitting-field-into-2-fields/m-p/190506#M54861 splunknewby 2015-07-03T02:15:29Z https://community.splunk.com/t5/Splunk-Search/Splitting-field-into-2-fields/m-p/190507#M54862 <P>Do you realize that <CODE>coalesce</CODE> does not really "combine" your IPs? In any case, This should do it:</P> <PRE><CODE>... | rex field=combined_ip "^(?&lt;combined_ipv4&gt;\d+\.\d+\.\d+\.\d+)|(?&lt;combined_ipv6&gt;.*)$" </CODE></PRE> Fri, 03 Jul 2015 03:09:37 GMT https://community.splunk.com/t5/Splunk-Search/Splitting-field-into-2-fields/m-p/190507#M54862 woodcock 2015-07-03T03:09:37Z