how do I specify a search where different fields for hostA and hostB when they are identified as IP addresses

[reneedeleon]

how do I specify a search where different fields for hostA and hostB when they are identified as IP addresses

I want to only pull stats for hostA and hostB when they are only identified as IP addresses and other specific names

index=stuff* blah OR blahblah  
| fillnull value=NULL hostA, hostB
| where match(hosA,"(\d{1,3}\.}{3}\d{1,3})")
| where match(hostB,"(\d{1,3}\.}{3}\d{1,3})")
| stats count by hostA, hostB

and

index=stuff* blah OR blahblah  
| fillnull value=NULL hostA, hostB
| regex hostA="^(\d{1,3}\.}{3}\d{1,3}).*"
| regex hostB="^(\d{1,3}\.}{3}\d{1,3}).*"
| stats count by hostA, hostB

I have tried both and neither turn up results am I taking the right approach?

[woodcock · Accepted solution]

Like this:

index=stuff* blah OR blahblah  
| where match(hostA, "^\d+.\d+.\d+.\d+") AND match(hostB, "^\d+.\d+.\d+.\d+")
| fillnull value="NULL" hostA, hostB
| stats count BY hostA hostB

[reneedeleon]

Thank you, but I had to make a small change.

| where match(hostA, "^\d+.\d+.\d+.\d+") AND match(hostB, "^\d+.\d+.\d+.\d+")

[woodcock]

I fixed my answer, too. I initially copied yours in your question and it is broken there, too.