How to create two new fields from a single field?

[bt149]

I have a log set from FW's. These logs have a field called "src."  From what I can tell, this field is populated with values such as:
FQDN (myhost.mydomain.com)
Console or telnet
10.0.0.1

I'm looking to have two fields created from the "src" field, one name IP if the value in "src" is an IP and "src_nt_host" if the value is not an ip_address.  A small sample from the logged event:

From: Console or telnet.
From: myhost.mydomain.com.
From: 10.0.0.1.

Any help / guidance is greatly appreciated.

[bt149]

Thank you but that didn't do the trick.

[gcusello · Accepted solution]

HI @bt149 ,

Sorry, please try this:

<your_search>
| rex field=src "(?<ip>\d+\.\d+\.\d+\.\d+)"
| eval src_nt_host=if(isnull(ip),src,"")

that I tested

gcusello_0-1679725939051.png

Ciao.

Giuseppe

[bt149]

Thank you Giuseppe!  This worked well.

[gcusello]

Hi @bt149 ,

you could try something like this:

<your_search>
| rex field=src "(?<ip>\d+\.\d+\.\d+\.\d+)"
| eval src_nt_host=if(isempty(ip),src,"")
| ...

Ciao.

Giuseppe