Getting reverse of IP address occurring in event ex " 2.20.111.140" should be shown as "140.111.20.2"

[yogeshpunia05]

Events have IP address and are needed to be shown in reverse form .

" 2.20.111.140" should be shown as "140.111.20.2"

[richgalloway]

Here's one way.

... | rex field=IPAddress "(?P<o1>\d+)\.(?P<o2>\d+)\.(?P<o3>\d+)\.(?P<o4>\d+)" | eval revIPAddress = o4.".".03.".".o2.".".01 | ...

[yogeshpunia05 · Accepted solution]

Thanks mehala for solution:

eval myField="2.20.111.140" |  rex field=myField mode=sed "s/(\d+)\.(\d+)\.(\d+)\.(\d+)/\4.\3.\2.\1/g".