Splunk Search

eval IP function - help

griggsy
New Member

Hello,

I have a search woring which returns single IP addresses as source for certain events. As part of this I want to pass the source address into the eval function. I have eval working with "eval ip = "10.0.0.2" I am then passing this into a lookup table and everything is great but I want to automate this so that the results from source are automatically passed through eval IP and then matched on my lookup so that I can return additional information form the lookup.

However I can't get the eval function to use the results from the source field returned as per the search. I have tried the following:

eval IP = source
eval source as IP

I must be missing something can someone put me out my misery please?

Tags (1)
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Whenever you use eval and you want to pass a field into it, you must have single tic's around the field value.

So if you wanted IP to be source, it would look like this

| eval IP='source'

Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...