How to Split hostname, IP and exclude IP from result

[Akmal57]

Hi, i want to list out all the hostname in my tipwire log.

but my hostname field are as below:

Hostname

10.10.10.10 : Host A

192.0.0.0 : Host B

My hostname and ip are mixed and in the same field.

How do i split the hostname, IP and list out all the hostname only.

Please assist me on this. Thank you

[bowesmana]

Use rex

| rex field=Hostname ".*:(?<host>.*)"

 which will give you a new field called host with everything from the : to the end

[Akmal57]

Hi @bowesmana , thank you for your response.

Your regex works great.

if i want the ip on another field, do i need to use another regex?

[bowesmana · Accepted solution]

If you want both fields you can either use rex to get both fields or split to split the string on the : character and then assign the first split to ip and the second to host.

| rex field=Hostname "(?<ip>[^:]*):(?<host>.*)"
OR
| eval tmp=split(Hostname, ":")
| eval ip=mvindex(tmp, 0), host=mvindex(tmp, 1)
| fields - tmp

rex is neater and you can make this an automatically extracted field, so you don't have to do it as part of the search.

[Akmal57]

Owh ok, both working great as expected.

Thank you for your assist on this.