Splunk Search

How to create two new fields from a single field?

bt149
Path Finder

I have a log set from FW's. These logs have a field called "src."  From what I can tell, this field is populated with values such as:
FQDN (myhost.mydomain.com)
Console or telnet
10.0.0.1

I'm looking to have two fields created from the "src" field, one name IP if the value in "src" is an IP and "src_nt_host" if the value is not an ip_address.  A small sample from the logged event:

From: Console or telnet.
From: myhost.mydomain.com.
From: 10.0.0.1.

Any help / guidance is greatly appreciated.

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

HI @bt149 ,

Sorry, please try this:

<your_search>
| rex field=src "(?<ip>\d+\.\d+\.\d+\.\d+)"
| eval src_nt_host=if(isnull(ip),src,"")

that I tested

gcusello_0-1679725939051.png

Ciao.

Giuseppe

View solution in original post

bt149
Path Finder

Thank you but that didn't do the trick.

0 Karma

gcusello
SplunkTrust
SplunkTrust

HI @bt149 ,

Sorry, please try this:

<your_search>
| rex field=src "(?<ip>\d+\.\d+\.\d+\.\d+)"
| eval src_nt_host=if(isnull(ip),src,"")

that I tested

gcusello_0-1679725939051.png

Ciao.

Giuseppe

bt149
Path Finder

Thank you Giuseppe!  This worked well.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @bt149 ,

you could try something like this:

<your_search>
| rex field=src "(?<ip>\d+\.\d+\.\d+\.\d+)"
| eval src_nt_host=if(isempty(ip),src,"")
| ...

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In September, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...