Splunk Search

How to create new field from a mv comma separated ip value field?

clozach
Path Finder

My IP field will come in as the following:

1.1.1.1,2.2.2.2

I need to extract the first IP and store it in another field (origin_ip) so that origin_ip's value is solely:

1.1.1.1

Thanks

0 Karma
1 Solution

woodcock
Esteemed Legend

You can do this as a calculated field

| makeresults | eval ip="1.1.1.1,2.2.2.2"
| eval origin_ip=replace(ip,",.*$","")

View solution in original post

0 Karma

jnudell_2
Builder

You could try:

... search stuff ...
| eval origin_ip = mvindex(split(myipfield, ","), 0)

OR

... search stuff ...
| eval origin_ip = replace(myipfield, ",.*", "")

0 Karma

woodcock
Esteemed Legend

You can do this as a calculated field

| makeresults | eval ip="1.1.1.1,2.2.2.2"
| eval origin_ip=replace(ip,",.*$","")

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There are a couple of ways to do that (possibly more)

... | rex field=ip "(?<origin_ip>[^,]+)" | ...

... | eval ips = split(ip, ",") | eval origin_ip = mvindex(ips, 0) | ...
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!