Splunk Search

Is there a function to check if field is an ip address or hostname?

brdr
Contributor

I have a field to evaluate if the value of the field is an IP address or a hostname. if it is an IP address do something, if it is a hostname do something else.

Is there a eval function to check if field is IP or not?

Labels (1)
Tags (2)
0 Karma
1 Solution

FrankVl
Ultra Champion

You can do something like this:

| eval fieldX = if(match(fieldX, "^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$"), "do something", "do something else")

See: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ConditionalFunctions#match.28SUBJ...

View solution in original post

msquicc
Explorer

here's what I landed on, in case it's helpful for folks in the future.  

 

| eval isIPV4 = if(match(IP,"^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.?\b){4}$"),"True","False")

 

The best regex for validating IPV4 is an ever-evolving conversation on stack overflow.  So, I used the latest from there, but from this highest rated answer, not the accepted one: https://stackoverflow.com/a/36760050/6376311

 

Since someone mentioned it, in order to validate private/public IPv4, I made myself an eval-based macro with the following:

 

case(
cidrmatch("10.0.0.0/8",$IP$),"False",
cidrmatch("172.16.0.0/12",$IP$),"False",
cidrmatch("192.168.0.0/16",$IP$),"False",
isnull($IP$) OR like($IP$,""), "False",
match($IP$,"^((25[0-5]|(2[0-4]|1\d|[1-9]|)\d)\.?\b){4}$"),"True")

 


Then, I can use it in any query like:

 

| eval Remote_Address_isExternal = `isExternalIPv4(Remote_Address)`

 

 

0 Karma

FrankVl
Ultra Champion

You can do something like this:

| eval fieldX = if(match(fieldX, "^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$"), "do something", "do something else")

See: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/ConditionalFunctions#match.28SUBJ...

brdr
Contributor

perfect. thanks!

0 Karma

Heff
Splunk Employee
Splunk Employee

Could you do something like this?
| eval isLocal=if(cidrmatch("10.0.0.0/24",ip), "local", "not local")

You could try 0.0.0.0/24 and see if that matches any IP address?
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...