Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Split IP Address in network and host part
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi everyone,
I've got a little problem. I want to split up IP addresses in network and host part (to create a chart for network segments).
some search | rex field=scrip "(?<Net>.*\..*\.)(?<Host>.*)"
This is the rex part that I got so far. But there are no fields created with "Net" or "Host". What am I doing wrong?
Thanks for your help!
Regards,
Maik
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What is the name of the field which contains the IP address? Is it really "scrip"? Perhaps there is a typo and it should be "srcip" or "src_ip".
I have modified your regex a little. Try it like this:
rex field=src_ip "(?<Net>\d+\.\d+\.\d+)\.(?<Host>\d+)"
I tested it like this which created a "Net" field and "Host" field:
| makeresults count=1 | eval src_ip="192.168.0.1" | rex field=src_ip "(?<Net>\d+\.\d+\.\d+)\.(?<Host>\d+)"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you going to assume that every IP address belongs to a /24 network? That's not always a valid assumption.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
In this case... or for this case the ip address always belongs to class C network.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hey,
It seems you have typo in your fieldname ... is your fieldname is scrip or script
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What is the name of the field which contains the IP address? Is it really "scrip"? Perhaps there is a typo and it should be "srcip" or "src_ip".
I have modified your regex a little. Try it like this:
rex field=src_ip "(?<Net>\d+\.\d+\.\d+)\.(?<Host>\d+)"
I tested it like this which created a "Net" field and "Host" field:
| makeresults count=1 | eval src_ip="192.168.0.1" | rex field=src_ip "(?<Net>\d+\.\d+\.\d+)\.(?<Host>\d+)"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Omg! Please ignore this whole question...
We've checked it twice but didn't see that I had a typo. Of course the field is srcip and not scrip.
If I write it in the correct way it works fine... 😉
Thank you for your hint.
Regards,
Maik
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...
Best Practices: Splunk auto adjust pipeline queue
