Splunk Search

Join multiple fields and change their name

Itai5468
New Member

Hi everyone,

I have some data with a lot of fields.

Some fields represent the same data, but with different field names...

For example, I have 20 servers reporting their IP, with their IP as part of the field name... the value of the fields has no meaning and is insignificant.

So the data (before any queries, as it arrives) looks like this:

Server1_1.1.1.1: 2

Server2_2.2.2.2:10

Server3_3.3.3.3:1

....

Server20_20.20.20.20: 5

 

What I would like to do is this:

Create a new field called "Server_IP". It's Values will be all the IP addresses from the original field NAMES:

Server_IP: [1.1.1.1 , 2.2.2.2 , 3.3.3.3 ,...., 20.20.20.20]

 

Many thanks!

Labels (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Itai5468,

if the IP is in the field name, probably it's also in the _raw, so try something a regex like this:

| rex "_(?<SERVER_IP>\d+\.\d+\.\d+\.\d+)"

if you share a sample of your logs I could be more precise in the regex, in particular, it could be possible to add an additional condition before "_".

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...