I have a list of IP addresses that I get from a eval combined_ip = coalesce(src_ip, dst_ip) command. This list combined_ips contains both IPv4 and IPv6 addresses and I would like to separate them into two new fields ipv4 and ipv6?
eval combined_ip = coalesce(src_ip, dst_ip)
How do would I create these two new fields?
Do you realize that coalesce does not really "combine" your IPs? In any case, This should do it:
... | rex field=combined_ip "^(?<combined_ipv4>\d+\.\d+\.\d+\.\d+)|(?<combined_ipv6>.*)$"
View solution in original post