Solved: Splitting field into 2 fields?

splunknewby · ‎07-02-2015

I have a list of IP addresses that I get from a eval combined_ip = coalesce(src_ip, dst_ip) command. This list combined_ips contains both IPv4 and IPv6 addresses and I would like to separate them into two new fields ipv4 and ipv6?

How do would I create these two new fields?

woodcock · ‎07-02-2015

Do you realize that coalesce does not really "combine" your IPs? In any case, This should do it:

... | rex field=combined_ip "^(?<combined_ipv4>\d+\.\d+\.\d+\.\d+)|(?<combined_ipv6>.*)$"

View solution in original post

woodcock · ‎07-02-2015

Do you realize that coalesce does not really "combine" your IPs? In any case, This should do it:

... | rex field=combined_ip "^(?<combined_ipv4>\d+\.\d+\.\d+\.\d+)|(?<combined_ipv6>.*)$"

Splitting field into 2 fields?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Introducing ITSI 5.0: Unified Visibility and Actionable Insights

Inside Splunk Agent Observability: Understanding Agent Behavior, Tokens & Costs

From Data to Insight: Announcing the Winners of the Splunk Dashboard Contest

Join the Conversation