Solved: Splitting field into 2 fields?

splunknewby · ‎07-02-2015

I have a list of IP addresses that I get from a eval combined_ip = coalesce(src_ip, dst_ip) command. This list combined_ips contains both IPv4 and IPv6 addresses and I would like to separate them into two new fields ipv4 and ipv6?

How do would I create these two new fields?

woodcock · ‎07-02-2015

Do you realize that coalesce does not really "combine" your IPs? In any case, This should do it:

... | rex field=combined_ip "^(?<combined_ipv4>\d+\.\d+\.\d+\.\d+)|(?<combined_ipv6>.*)$"

View solution in original post

woodcock · ‎07-02-2015

Do you realize that coalesce does not really "combine" your IPs? In any case, This should do it:

... | rex field=combined_ip "^(?<combined_ipv4>\d+\.\d+\.\d+\.\d+)|(?<combined_ipv6>.*)$"

Splitting field into 2 fields?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

A Four-Part Event Series: State of Observability - Where AI Meets Performance

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Build resilience for the agentic era: Join us at Splunk Go San Jose

Join the Conversation