Field extraction from data within backslashes

[mbasharat]

Hi,

I have dateset that contains IP addresses. IP Addresses are coming in variations due to ranges they are assigned to separated by \ backslashes. I need them to be extracted in multiple fields regardless of how many variations are there. See sample data below:

1.2.3.4\n4.5.6.7\n8.9.1.2
1.2.3.4\n4.5.6.7\n
1.2.3.4\n4.5.6.7
1.2.3.4\n4.5.6.7\n8.9.1.2

I need them like:
1.2.3.4\n4.5.6.7\n8.9.1.2
Value1: 1.2.3.4
Value2: 4.5.6.7
Value3: 8.9.1.2
Value4: and so on.....

So basically all values within backslash, I need them separated out in fields. Also, the letter "n" or any alphabets attached to any IP also needs to go.

Thanks in-advance!

[to4kawa]

| makeresults 
| eval _raw="1.2.3.4\n4.5.6.7\n8.9.1.2
1.2.3.4\n4.5.6.7\n
1.2.3.4\n4.5.6.7
1.2.3.4\n4.5.6.7\n8.9.1.2"
| multikv noheader=t 
| fields _*
| rename COMMENT as "this is sample, check this. from here, the logic"
| rex max_match=0 "(?<data>[\d.]+)"
| streamstats count as session
| mvexpand data
| streamstats count as cols by session
| eval cols="col".cols
| xyseries session cols data

[mbasharat]

Both yours and Rich's solutions work great but rich's solution is less typing :). Accepting Rich's and upvoting t04kawa! 🙂

Thank you both!

[richgalloway · Accepted solution]

The IP addresses are not separated by backslashes, they're separated by newlines (\n). To split them up, use the split command followed by mvexpand. Assuming the addresses are in a field called 'foo', this should do it.

... | eval ips = split(foo, "\n") | mvexpand ips

[mbasharat]

I used the same eval but with backslash only and it did not work and I have no idea why, added \n instead like yours and worked perfectly. THANKS!!

BTW, do you happen to know the reason why just backslash does not get picked up?

Both yours and @to4kawa solutions work great but rich's solution is less typing :). Accepting RIch's and upvoting t04kawa! 🙂

Thank you both!

[richgalloway]

Backslash by itself is not picked up because it is the escape character. That means it modifies the character that follows it. To match the literal backslash you must escape it \\\.

[mbasharat]

Works. Thanks!!!

[mbasharat]

One more thing to add, below also worked:

| makemv delim="\n" IP_Extracted
| mvexpand IP_Extracted