Is there any way to tell Splunk to extract the IP address field in an error log because it doesn't recognize the field?

[allyandrews14]

I have to find out the top 50 Ip addresses for error logs, but they are in a different format than Splunk recognizes. The IP information are listed in the _raw field of the log. I'm not sure how to extract them so I can look at them and chart just the IP addresses in the error logs. I know I can highlight over the IP addresses, but it only shows the logs containing that specific IP address. Is there any way I can tell Splunk exactly what field I want it to extract?

[sdaniels]

Yes, this will help.

http://docs.splunk.com/Documentation/Splunk/latest/User/InteractiveFieldExtractionExample

You can also use the rex command and do it within your search.

http://splunk-base.splunk.com/answers/48882/need-to-extract-ip-address