Getting Data In

How do I parse IPv6 with collapsed zero's and IPv4 quad to just IPv4


I am getting IPv6 with collapsed zero's and IPv4 quad (ie "fe80::") for source and I want to parse out the IPv6 part of that field.  What do I need to add in my prop to parse that part out?  Thank you for any and all help.

0 Karma

Super Champion

@cachexploit -It seems like there is no space or any other characters between IPv6 address and IPv4 address.

For example:


There could be two scenarios here:

  • IPv6=2001:0db8:0001:0000:0000:0ab9:C0A8:102 & IPv4=
  • OR
  • IPv6=2001:0db8:0001:0000:0000:0ab9:C0A8:10    & IPv4=

Is this what you are saying. Or Am I missing anything here?


0 Karma


After doing some more digging it appears that the machines logging into Splunk have IPv6 enabled BUT the sources connecting to those machines do not have IPv6 enabled.  So there is the address reporting ::ffff:, basically stating to the Splunk UF machine that this source is working in IPv4.  What I am looking for is how to alter the group logging of these machines so that Splunk parses them correctly and I drops the IPv6 part of this address?

0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...