Split ip and port into two fields using delims

[aelliott]

I would like to split a field called "destination" and "original_source" into 2 fields, each is an ip:port or [ipv6]:port

ex 1.2.3.4:443
   [ff:33::434:sdfsf]:443

here is what i currently have to do this:

transforms.conf:

[src_translated_tran]
SOURCE_KEY = original_src
DELIMS = ":"
FIELDS = src_translated_ip, src_translated_port

[destination_tran]
SOURCE_KEY = destination
DELIMS = ":"
FIELDS = dest, dest_port

props.conf

[isafwsw3c]
REPORT-src_translated = src_translated_tran
REPORT-destination_tran = destination_tran

These are not working, any help would be appreciated.

[somesoni2 · Accepted solution]

These worked for me. I created these from UI (my system takes ages to restart splunk). In case you don't see the fields, try with adding "|extract reload=t" in the search to reload the field extraction configuration.

transforms.conf.

[destination_tran]
FORMAT = dest::$1 dest_port::$2
REGEX = ([\w|\d]+\.[\w|\d]+\.[\w|\d]+\.[\w|\d]+):(\d+)
SOURCE_KEY = destination

[src_translated_tran]
FORMAT = src_translated_ip::$1 src_translated_port::$2
REGEX = (\[[\w|\d]+\.[\w|\d]+\.[\w|\d]+\.[\w|\d]+\]):(\d+)
SOURCE_KEY = destination

[somesoni2]

I just realized its happening for me too. I tried restart/refresh but same behavior (shows only after explicit "|extract reload=t").

[aelliott]

Strange, dest only shows up when I have |extract reload=t on the end of the search

[aelliott]

Thanks!, the |extract reload=t did the trick. Strange how my restart of splunk did not reload the extracts.