Splunk Search

how to expand multiple ip addresses on more fields?

francesco1g
Engager

Hi, i have more ip address in a field like this:

host |     IP              

h1         10.0.2.2; 10.0.2.1

h2         10.0.2.3; 10.0.1.1

h3         10.2.2.2

 

I want expand the IP field like this

h1 10.0.2.2

h1 10.0.2.1

h2 10.0.2.3

h2 10.0.1.1

h3 10.2.2.2

 

is there a way to produce a result like this?

 

Thanks

Labels (1)
0 Karma
1 Solution

ashvinpandey
Contributor

@francesco1g Use the below command (use your field name instead of ip):

| eval ip=split(ip,";") 
| mvexpand ip

Also, If this reply helps you, an upvote would be appreciated.

View solution in original post

ashvinpandey
Contributor

@francesco1g Use the below command (use your field name instead of ip):

| eval ip=split(ip,";") 
| mvexpand ip

Also, If this reply helps you, an upvote would be appreciated.

Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...