Splunk Search

How to remove everything after a colon in an existing field?

kennyja
Explorer

I have a field that contains both IP address and port number separated by a semicolon (example 10.1.1.1:23) How do I use rex to trim off the port# leaving me with just the IP address?

0 Karma

sundareshr
Legend

if you're wanting to replace the field value, @jkat54 solution should work. Howeverm if you only want to extract the IP into a field, try this

.... | rex field=_raw "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

This rex will extract all IP address in a field called ip.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Hi, try this:

...| rex mode=sed field=fieldName "s/\:\d+//g"
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!