What is the most popular field name for an IP in raw data?

[alauri]

Hi guys,

What is the most popular field name for an IP?
I'd like to apply a workflow_action for all the possible IPs I can find in raw.

Thanks in advance!

[yannK · Accepted solution]

they are many , depending of the source of data.
IP, Ip , ip, clientip, source_ip, "Internet Protocol", source, dest, dest_ip etc...

[yannK]

The common information model tries to normalize it a bit, you can take a look at their aliases.

https://splunkbase.splunk.com/app/1621/

[alauri]

Thank you very much @yannK