Splunk Search

Getting reverse of IP address occurring in event ex " 2.20.111.140" should be shown as "140.111.20.2"

Explorer

Events have IP address and are needed to be shown in reverse form .

" 2.20.111.140" should be shown as "140.111.20.2"

0 Karma
1 Solution

Explorer

Thanks mehala for solution:

eval myField="2.20.111.140" |  rex field=myField mode=sed "s/(\d+)\.(\d+)\.(\d+)\.(\d+)/\4.\3.\2.\1/g".

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Here's one way.

... | rex field=IPAddress "(?P<o1>\d+)\.(?P<o2>\d+)\.(?P<o3>\d+)\.(?P<o4>\d+)" | eval revIPAddress = o4.".".03.".".o2.".".01 | ...
---
If this reply helps you, an upvote would be appreciated.
0 Karma

Explorer

Thanks mehala for solution:

eval myField="2.20.111.140" |  rex field=myField mode=sed "s/(\d+)\.(\d+)\.(\d+)\.(\d+)/\4.\3.\2.\1/g".

View solution in original post

0 Karma