Splunk Search

How to separate values in a field to new fields?

atebysandwich
Path Finder

I have a lookup with a field called IP. The field has values that have multiple IPs in them an I would like to sperate them out each into their own field. Some IPs are separated by colons and some are separated by semicolons, and some fields have 3+ IPs. Regardless, I need the IPs in the field beyond the first one to be in their own Field column named IP2 and IP3, etc. 

What I have:

IP

1.1.1.1,2.2.2.2 

or 

IP 

1.1.1.1;2.2.2.2

I've tried something like the below but the makemv only seems to work for the "," and the seperated IPs still show up in the original IP field. 

| makemv delim=";" allowempty=true IP
| makemv delim="," allowempty=true IP
| mvexpand IP

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Sorry, I missed that requirement.  Creating separate fields for each IP address is doable with a fixed number of IPs, but not for an arbitrary number of them.

| inputlookup mylookup.csv
``` Normalize the separator ```
| eval IP = replace(IP, ";", ",")
``` Separate the IP addresses ```
| eval IP = split(IP, ",")
``` Give each IP address its own field ```
| eval IP=mvindex(IP, 0), IP2=mvindex(IP, 1), IP3=mvindex(IP, 2)
| table DNS IP*
``` Write the results back to the lookup, if desired ```
``` | outputlookup mylookup.csv ```
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There are multiple ways to do that.  Here's one.

| inputlookup mylookup.csv
``` Normalize the separator ```
| eval IP = replace(IP, ";", ",")
``` Separate the IP addresses ```
| eval IP = split(IP, ",")
``` Give each IP address its own event ```
| mvexpand IP
``` Write the results back to the lookup, if desired ```
``` | outputlookup mylookup.csv ```
---
If this reply helps you, Karma would be appreciated.
0 Karma

atebysandwich
Path Finder

This worked up until the mexpand. It normalized the punctuation and spit the IPs, but each IP sis till under the same original field of IP. 

It may have helped if I mentioned the other fields: DNS IP OS. Doing what was suggested, this is what I have currently:

DNS         IP

server1   1.1.1.1

server1    2.2.2.2

I would like to have 2.2.2.2 in a seperate field named IP2. And if the server has more than two IPS, a field named IP3 and so on. 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Sorry, I missed that requirement.  Creating separate fields for each IP address is doable with a fixed number of IPs, but not for an arbitrary number of them.

| inputlookup mylookup.csv
``` Normalize the separator ```
| eval IP = replace(IP, ";", ",")
``` Separate the IP addresses ```
| eval IP = split(IP, ",")
``` Give each IP address its own field ```
| eval IP=mvindex(IP, 0), IP2=mvindex(IP, 1), IP3=mvindex(IP, 2)
| table DNS IP*
``` Write the results back to the lookup, if desired ```
``` | outputlookup mylookup.csv ```
---
If this reply helps you, Karma would be appreciated.
0 Karma

atebysandwich
Path Finder

Thank you for your help 

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...