Getting Data In

How do I clear 0s from the Ip?

noott211
Path Finder

But the log says 017.002.100.103. I am receiving data from universal forwarder and I would like to remove 0 in front of me Is there a way?

i want 17.2.100.103

Tags (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults | eval ip="017.002.100.103" 
| eval ip=replace(ip,"(^|\.)(0*)(\d+)","\1\3")

View solution in original post

0 Karma

somesoni2
Revered Legend

In search, you can do something like this

| makeresults | eval ip="017.002.100.103" 
| eval ip=replace(ip,"^0*(.+)","\1") 
0 Karma

noott211
Path Finder

The command is removed only at the beginning I want every part of it

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| makeresults | eval ip="017.002.100.103" 
| eval ip=replace(ip,"(^|\.)(0*)(\d+)","\1\3")
0 Karma
Get Updates on the Splunk Community!

Index This | A sphere has three, a circle has two, and a point has zero. What is it?

September 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...