Splunk Search

How to filter ipv6 addresses and keep only ipv4?

woodentree
Communicator

Hi,


We have a lookup file with some ip addresses. It could be in IPv4 or IPv6 format. There is also could be one or multiple ip addresses. Something like that:

asset_name | ip
asset_1    | 123.34.43.12, 2a01:bc02:3d:4500:e6f
asset_2    | fe98::7d65:cb43:211a:12bc, 12.56.123.78
asset_3    | 
asset_4    | 45.123.98.76
asset_5    | ab12::3456:cd78:9e11:12ab
asset_6    | 234.123.91.82, 67.12.123.54


We’d like to keep only IPv4 addresses, so the final result should look like that:

asset_name | ip
asset_1    | 123.34.43.12
asset_2    | 12.56.123.78
asset_3    | 
asset_4    | 45.123.98.76
asset_5    | 
asset_6    | 234.123.91.82, 67.12.123.54


Do you have an idea how we can implement this type of filtering?
Thanks.

Labels (1)
Tags (3)
0 Karma
1 Solution

maciep
Champion

I think you can use mvfilter here....something like this (untested)

| inputlookup <your_lookup>
| eval ip = split(ip,",")
| eval ip = mvfilter(match(ip,"\d+\.\d+\.\d+\.\d+"))
| eval ip = mvjoin(ip,",")
| outputlookup <your_lookup>

View solution in original post

maciep
Champion

I think you can use mvfilter here....something like this (untested)

| inputlookup <your_lookup>
| eval ip = split(ip,",")
| eval ip = mvfilter(match(ip,"\d+\.\d+\.\d+\.\d+"))
| eval ip = mvjoin(ip,",")
| outputlookup <your_lookup>

woodentree
Communicator

Hi @maciep 

Perfect! It works great.

Thanks for the help.

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...