Splunk Search

How to remove everything after a colon in an existing field?

kennyja
Explorer

I have a field that contains both IP address and port number separated by a semicolon (example 10.1.1.1:23) How do I use rex to trim off the port# leaving me with just the IP address?

0 Karma

sundareshr
Legend

if you're wanting to replace the field value, @jkat54 solution should work. Howeverm if you only want to extract the IP into a field, try this

.... | rex field=_raw "(?<ip>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"

This rex will extract all IP address in a field called ip.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Hi, try this:

...| rex mode=sed field=fieldName "s/\:\d+//g"
0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...