Splunk Search
Highlighted

Splitting field into 2 fields?

Path Finder

I have a list of IP addresses that I get from a eval combined_ip = coalesce(src_ip, dst_ip) command. This list combined_ips contains both IPv4 and IPv6 addresses and I would like to separate them into two new fields ipv4 and ipv6?

How do would I create these two new fields?

Tags (3)
0 Karma
Highlighted

Re: Splitting field into 2 fields?

Esteemed Legend

Do you realize that coalesce does not really "combine" your IPs? In any case, This should do it:

... | rex field=combined_ip "^(?<combined_ipv4>\d+\.\d+\.\d+\.\d+)|(?<combined_ipv6>.*)$"

View solution in original post

0 Karma