Events have IP address and are needed to be shown in reverse form .
" 2.20.111.140" should be shown as "140.111.20.2"
Thanks mehala for solution:
eval myField="2.20.111.140" | rex field=myField mode=sed "s/(\d+)\.(\d+)\.(\d+)\.(\d+)/\4.\3.\2.\1/g".
Here's one way.
... | rex field=IPAddress "(?P<o1>\d+)\.(?P<o2>\d+)\.(?P<o3>\d+)\.(?P<o4>\d+)" | eval revIPAddress = o4.".".03.".".o2.".".01 | ...
Thanks mehala for solution:
eval myField="2.20.111.140" | rex field=myField mode=sed "s/(\d+)\.(\d+)\.(\d+)\.(\d+)/\4.\3.\2.\1/g".