My IP field will come in as the following:
1.1.1.1,2.2.2.2
I need to extract the first IP and store it in another field (origin_ip) so that origin_ip's value is solely:
1.1.1.1
Thanks
You can do this as a calculated field
| makeresults | eval ip="1.1.1.1,2.2.2.2"
| eval origin_ip=replace(ip,",.*$","")
You could try:
... search stuff ...
| eval origin_ip = mvindex(split(myipfield, ","), 0)
OR
... search stuff ...
| eval origin_ip = replace(myipfield, ",.*", "")
You can do this as a calculated field
| makeresults | eval ip="1.1.1.1,2.2.2.2"
| eval origin_ip=replace(ip,",.*$","")
There are a couple of ways to do that (possibly more)
... | rex field=ip "(?<origin_ip>[^,]+)" | ...
... | eval ips = split(ip, ",") | eval origin_ip = mvindex(ips, 0) | ...