I think you want to add an EVAL line to your props.conf file under the appropriate stanza to generate this field:
EVAL-IP = mvappend(internal_ip,nat_ip,internet_ip,ipv4,ipv6)
Then you can search for any flavor of IP address using IP=<addr goes here> and it should show up in your results. If you want to test it beforehand, you can do a search-bar search with a clause like:
initial search | eval IP=mvappend(internal_ip,nat_ip,internet_ip,ipv4,ipv6) | search IP=some.addr
and see whether you get the results you want.
(If you haven't done so already, read http://docs.splunk.com/Documentation/Splunk/6.1.3/Admin/Propsconf to make sure you're working with an appropriately-written stanza in your props.conf .)
(Note: This does not appear to be the documented behavior of mvappend , but this is how it works in real life today.)
... View more