How to extract multiple values (IP addresses) into one field?

[rubeniturrieta]

Hi to everyone,

If I have this data, a lot of IPs, how can I extract multiple values for a field? (For a config file, not search) For example:

Ip_address=10.1.144.80, 10.1.148.183, etc.

{
10.1.144.80
10.1.148.183
10.20.213.111
10.26.154.46
10.26.158.154
10.26.158.176
10.70.39.4
10.26.158.177
10.76.0.60
10.76.0.71
10.1.144.58
10.76.22.69
10.76.0.58
10.26.194.100
10.76.0.44
10.76.0.56
10.76.24.118
}

I'll be grateful for your help

Regards

[aljohnson_splun · Accepted solution]

Permanently

Use MV_ADD=true. Read more here.

Or you could use fields.conf or check out this answer using props.conf & transforms.conf.

---

Via Search Commands

Just add this to your search:

... | rex "([[ipv4]])" | makemv ip

Or, if your ip is already extracted as Ip_address, you can make it multivalued with makemv:

... | makemv Ip_address

[martin_mueller]

Nitpicking: The "Permanently" approach is also search-time 😛

[aljohnson_splun]

You are right. Edited.

[theeansible]

WOW i didn't know about

| rex "([[ipv4]])"

Is there a list somewhere with all other regexes that ship with splunk?

[aljohnson_splun]

@theeansible check transforms.conf

At the bottom, you'll see

###### BASIC MODULAR REGULAR EXPRESSIONS DEFINITION START ###########

🙂

[rubeniturrieta]

Thanks you aljohnson, but i need it for a permanent extraction, not in the search.

[aljohnson_splun]

I see. I edited my answer to reference permanent extractions.

[rubeniturrieta]

Thanks you very much