You can always use the
rex command to create/modify a field that is always extracted. For example:
| makeresults | eval IP="10.0.0.1:9997" | rex field=IP "(?<myIP>[\d.]+)"
will result in
myIP containing just the IP, and not the port from the
For future reference, it is always best to give some example data with your question so that it is easier to help answer you particular problem.