Splunk Search

How to extract multiple values (IP addresses) into one field?

rubeniturrieta
Communicator

Hi to everyone,

If I have this data, a lot of IPs, how can I extract multiple values for a field? (For a config file, not search) For example:

Ip_address=10.1.144.80, 10.1.148.183, etc.

{
10.1.144.80
10.1.148.183
10.20.213.111
10.26.154.46
10.26.158.154
10.26.158.176
10.70.39.4
10.26.158.177
10.76.0.60
10.76.0.71
10.1.144.58
10.76.22.69
10.76.0.58
10.26.194.100
10.76.0.44
10.76.0.56
10.76.24.118
}

I'll be grateful for your help

Regards

0 Karma
1 Solution

aljohnson_splun
Splunk Employee
Splunk Employee

Permanently

Use MV_ADD=true. Read more here.

Or you could use fields.conf or check out this answer using props.conf & transforms.conf.


Via Search Commands

Just add this to your search:

... | rex "([[ipv4]])" | makemv ip

Or, if your ip is already extracted as Ip_address, you can make it multivalued with makemv:

... | makemv Ip_address

View solution in original post

aljohnson_splun
Splunk Employee
Splunk Employee

Permanently

Use MV_ADD=true. Read more here.

Or you could use fields.conf or check out this answer using props.conf & transforms.conf.


Via Search Commands

Just add this to your search:

... | rex "([[ipv4]])" | makemv ip

Or, if your ip is already extracted as Ip_address, you can make it multivalued with makemv:

... | makemv Ip_address

martin_mueller
SplunkTrust
SplunkTrust

Nitpicking: The "Permanently" approach is also search-time 😛

aljohnson_splun
Splunk Employee
Splunk Employee

You are right. Edited.

0 Karma

theeansible
Path Finder

WOW i didn't know about

| rex "([[ipv4]])"

Is there a list somewhere with all other regexes that ship with splunk?

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

@theeansible check transforms.conf

At the bottom, you'll see

###### BASIC MODULAR REGULAR EXPRESSIONS DEFINITION START ###########

🙂

0 Karma

rubeniturrieta
Communicator

Thanks you aljohnson, but i need it for a permanent extraction, not in the search.

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

I see. I edited my answer to reference permanent extractions.

0 Karma

rubeniturrieta
Communicator

Thanks you very much

0 Karma
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...