Splunk Search

Is there a function to check if field is an ip address or hostname?

brdr
Contributor

I have a field to evaluate if the value of the field is an IP address or a hostname. if it is an IP address do something, if it is a hostname do something else.

Is there a eval function to check if field is IP or not?

Labels (1)
Tags (2)
0 Karma
1 Solution

FrankVl
Ultra Champion

You can do something like this:

| eval fieldX = if(match(fieldX, "^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$"), "do something", "do something else")

See: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ConditionalFunctions#match.28SUBJ...

View solution in original post

msquicc
Explorer

here's what I landed on, in case it's helpful for folks in the future.  

 

| eval isIPV4 = if(match(IP,"^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.?\b){4}$"),"True","False")

 

The best regex for validating IPV4 is an ever-evolving conversation on stack overflow.  So, I used the latest from there, but from this highest rated answer, not the accepted one: https://stackoverflow.com/a/36760050/6376311

 

Since someone mentioned it, in order to validate private/public IPv4, I made myself an eval-based macro with the following:

 

case(
cidrmatch("10.0.0.0/8",$IP$),"False",
cidrmatch("172.16.0.0/12",$IP$),"False",
cidrmatch("192.168.0.0/16",$IP$),"False",
isnull($IP$) OR like($IP$,""), "False",
match($IP$,"^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.?\b){4}$"),"True")

 


Then, I can use it in any query like:

 

| eval Remote_Address_isExternal = `isExternalIPv4(Remote_Address)`

 

 

0 Karma

FrankVl
Ultra Champion

You can do something like this:

| eval fieldX = if(match(fieldX, "^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$"), "do something", "do something else")

See: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ConditionalFunctions#match.28SUBJ...

brdr
Contributor

perfect. thanks!

0 Karma

Heff
Splunk Employee
Splunk Employee

Could you do something like this?
| eval isLocal=if(cidrmatch("10.0.0.0/24",ip), "local", "not local")

You could try 0.0.0.0/24 and see if that matches any IP address?
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...