Splunk Search

How to create new field from a mv comma separated ip value field?

Explorer

My IP field will come in as the following:

1.1.1.1,2.2.2.2

I need to extract the first IP and store it in another field (originip) so that originip's value is solely:

1.1.1.1

Thanks

0 Karma
1 Solution

Esteemed Legend

You can do this as a calculated field

| makeresults | eval ip="1.1.1.1,2.2.2.2"
| eval origin_ip=replace(ip,",.*$","")

View solution in original post

0 Karma

Builder

You could try:

... search stuff ...
| eval origin_ip = mvindex(split(myipfield, ","), 0)

OR

... search stuff ...
| eval origin_ip = replace(myipfield, ",.*", "")

0 Karma

Esteemed Legend

You can do this as a calculated field

| makeresults | eval ip="1.1.1.1,2.2.2.2"
| eval origin_ip=replace(ip,",.*$","")

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

There are a couple of ways to do that (possibly more)

... | rex field=ip "(?<origin_ip>[^,]+)" | ...

... | eval ips = split(ip, ",") | eval origin_ip = mvindex(ips, 0) | ...
---
If this reply helps you, an upvote would be appreciated.
0 Karma