Splunk Search

In a text field, am I able to detect if a user entered an IP Address or a HostName?

Explorer

Hi,

In a text field, I would like to be able to detect if a user entered an IP Address or a HostName. At the moment, a user can search with Hostnames divided by a comma and it will do a search on HostNames. Is there a condition where, if the input is an IP address, it will look for IPadresses?

    <input type="text" token="server_lookup">
      <label>Server Lookup</label>
      <change>
      <condition if IP Address>
        <eval token="splitted_search">"IPAddress=\"".mvjoin(split(replace($value$," ",""),","),"\" OR IPAddress=\"")."\""</eval>
       <condition else>
        <eval token="splitted_search">"HostName=\"".mvjoin(split(replace($value$," ",""),","),"\" OR HostName=\"")."\""</eval>
      </change>
      <default>*</default>
    </input>

Thanks

0 Karma

Loves-to-Learn Everything
0 Karma