Splunk Search

Join multiple fields and change their name

Itai5468
New Member

Hi everyone,

I have some data with a lot of fields.

Some fields represent the same data, but with different field names...

For example, I have 20 servers reporting their IP, with their IP as part of the field name... the value of the fields has no meaning and is insignificant.

So the data (before any queries, as it arrives) looks like this:

Server1_1.1.1.1: 2

Server2_2.2.2.2:10

Server3_3.3.3.3:1

....

Server20_20.20.20.20: 5

 

What I would like to do is this:

Create a new field called "Server_IP". It's Values will be all the IP addresses from the original field NAMES:

Server_IP: [1.1.1.1 , 2.2.2.2 , 3.3.3.3 ,...., 20.20.20.20]

 

Many thanks!

Labels (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Itai5468,

if the IP is in the field name, probably it's also in the _raw, so try something a regex like this:

| rex "_(?<SERVER_IP>\d+\.\d+\.\d+\.\d+)"

if you share a sample of your logs I could be more precise in the regex, in particular, it could be possible to add an additional condition before "_".

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...