Splunk Search

How to extract multiple values (IP addresses) into one field?

Communicator

Hi to everyone,

If I have this data, a lot of IPs, how can I extract multiple values for a field? (For a config file, not search) For example:

Ip_address=10.1.144.80, 10.1.148.183, etc.

{
10.1.144.80
10.1.148.183
10.20.213.111
10.26.154.46
10.26.158.154
10.26.158.176
10.70.39.4
10.26.158.177
10.76.0.60
10.76.0.71
10.1.144.58
10.76.22.69
10.76.0.58
10.26.194.100
10.76.0.44
10.76.0.56
10.76.24.118
}

I'll be grateful for your help

Regards

0 Karma
1 Solution

Splunk Employee
Splunk Employee

Permanently

Use MV_ADD=true. Read more here.

Or you could use fields.conf or check out this answer using props.conf & transforms.conf.


Via Search Commands

Just add this to your search:

... | rex "([[ipv4]])" | makemv ip

Or, if your ip is already extracted as Ip_address, you can make it multivalued with makemv:

... | makemv Ip_address

View solution in original post

Splunk Employee
Splunk Employee

Permanently

Use MV_ADD=true. Read more here.

Or you could use fields.conf or check out this answer using props.conf & transforms.conf.


Via Search Commands

Just add this to your search:

... | rex "([[ipv4]])" | makemv ip

Or, if your ip is already extracted as Ip_address, you can make it multivalued with makemv:

... | makemv Ip_address

View solution in original post

SplunkTrust
SplunkTrust

Nitpicking: The "Permanently" approach is also search-time 😛

Splunk Employee
Splunk Employee

You are right. Edited.

0 Karma

Path Finder

WOW i didn't know about

| rex "([[ipv4]])"

Is there a list somewhere with all other regexes that ship with splunk?

0 Karma

Splunk Employee
Splunk Employee

@theeansible check transforms.conf

At the bottom, you'll see

###### BASIC MODULAR REGULAR EXPRESSIONS DEFINITION START ###########

🙂

0 Karma

Communicator

Thanks you aljohnson, but i need it for a permanent extraction, not in the search.

0 Karma

Splunk Employee
Splunk Employee

I see. I edited my answer to reference permanent extractions.

0 Karma

Communicator

Thanks you very much

0 Karma