Splunk Search

Removing punctuation from multivalue field and put value in own event?

atebysandwich
Path Finder

I'm pretty sure the answer to my question is regex but I'm not too savy with it. 

I have a few values in an IP field formatted like the below example. How can I remove the [] , and ' and get each IP in its own event? 

['10.1.1.1', '10.2.2.2']
Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

It can be done without regex.

| makeresults | eval data="['10.1.1.1','10.2.2.2']"
``` Above defines test data.  Delete IRL ```
``` Break the IP addresses apart ```
| eval data=split(data,",") 
``` Put each IP address in its own event ```
| mvexpand data
``` Trim out excess chars ```
| eval data=trim(trim(data,"[]"), "'")
---
If this reply helps you, Karma would be appreciated.
0 Karma

yeahnah
Motivator

Hi @atebysandwich 

Here's a run anywhere example that will meet your needs

| makeresults
| eval IPs="['10.1.1.1', '10.2.2.2']"
  ``` above just creates dummy value ```
| rex field=IPs mode=sed "s/[\[\]']//g"   ``` strip unwanted characters to normalise the field ```
| eval IP=split(IPs, ", ")   ``` make the field a mutlivalue field ```
| mvexpand IP    ``` expand each value to an event ```

yeahnah_0-1680034293693.png

 

Hope this helps

 

0 Karma

atebysandwich
Path Finder

While using your suggestion, the "dummy" data in line two of your suggestion made each event have the same two IPS while the lookup had over 7k. However, I was able to us eth regex and other example of regex to remove the spaces and achieve what I wanted. 

| rex field=IP mode=sed "s/[\[\]']//g"
| makemv IP delim="," 
| rex field=IP mode=sed "s/(^\s+)|(\s+$)//g"
| mvexpand IP
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...