Getting Data In

Split ip and port into two fields using delims

aelliott
Motivator

I would like to split a field called "destination" and "original_source" into 2 fields, each is an ip:port or [ipv6]:port

ex 1.2.3.4:443
   [ff:33::434:sdfsf]:443

here is what i currently have to do this:

transforms.conf:

[src_translated_tran]
SOURCE_KEY = original_src
DELIMS = ":"
FIELDS = src_translated_ip, src_translated_port

[destination_tran]
SOURCE_KEY = destination
DELIMS = ":"
FIELDS = dest, dest_port

props.conf

[isafwsw3c]
REPORT-src_translated = src_translated_tran
REPORT-destination_tran = destination_tran

These are not working, any help would be appreciated.

1 Solution

somesoni2
Revered Legend

These worked for me. I created these from UI (my system takes ages to restart splunk). In case you don't see the fields, try with adding "|extract reload=t" in the search to reload the field extraction configuration.

transforms.conf.

[destination_tran]
FORMAT = dest::$1 dest_port::$2
REGEX = ([\w|\d]+\.[\w|\d]+\.[\w|\d]+\.[\w|\d]+):(\d+)
SOURCE_KEY = destination

[src_translated_tran]
FORMAT = src_translated_ip::$1 src_translated_port::$2
REGEX = (\[[\w|\d]+\.[\w|\d]+\.[\w|\d]+\.[\w|\d]+\]):(\d+)
SOURCE_KEY = destination

View solution in original post

somesoni2
Revered Legend

These worked for me. I created these from UI (my system takes ages to restart splunk). In case you don't see the fields, try with adding "|extract reload=t" in the search to reload the field extraction configuration.

transforms.conf.

[destination_tran]
FORMAT = dest::$1 dest_port::$2
REGEX = ([\w|\d]+\.[\w|\d]+\.[\w|\d]+\.[\w|\d]+):(\d+)
SOURCE_KEY = destination

[src_translated_tran]
FORMAT = src_translated_ip::$1 src_translated_port::$2
REGEX = (\[[\w|\d]+\.[\w|\d]+\.[\w|\d]+\.[\w|\d]+\]):(\d+)
SOURCE_KEY = destination

somesoni2
Revered Legend

I just realized its happening for me too. I tried restart/refresh but same behavior (shows only after explicit "|extract reload=t").

0 Karma

aelliott
Motivator

Strange, dest only shows up when I have |extract reload=t on the end of the search

0 Karma

aelliott
Motivator

Thanks!, the |extract reload=t did the trick. Strange how my restart of splunk did not reload the extracts.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...