Splunk Search

eval IP function - help

griggsy
New Member

Hello,

I have a search woring which returns single IP addresses as source for certain events. As part of this I want to pass the source address into the eval function. I have eval working with "eval ip = "10.0.0.2" I am then passing this into a lookup table and everything is great but I want to automate this so that the results from source are automatically passed through eval IP and then matched on my lookup so that I can return additional information form the lookup.

However I can't get the eval function to use the results from the source field returned as per the search. I have tried the following:

eval IP = source
eval source as IP

I must be missing something can someone put me out my misery please?

Tags (1)
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Whenever you use eval and you want to pass a field into it, you must have single tic's around the field value.

So if you wanted IP to be source, it would look like this

| eval IP='source'

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...