Solved: Splitting field into 2 fields?

splunknewby · ‎07-02-2015

I have a list of IP addresses that I get from a eval combined_ip = coalesce(src_ip, dst_ip) command. This list combined_ips contains both IPv4 and IPv6 addresses and I would like to separate them into two new fields ipv4 and ipv6?

How do would I create these two new fields?

woodcock · ‎07-02-2015

Do you realize that coalesce does not really "combine" your IPs? In any case, This should do it:

... | rex field=combined_ip "^(?<combined_ipv4>\d+\.\d+\.\d+\.\d+)|(?<combined_ipv6>.*)$"

View solution in original post

woodcock · ‎07-02-2015

Do you realize that coalesce does not really "combine" your IPs? In any case, This should do it:

... | rex field=combined_ip "^(?<combined_ipv4>\d+\.\d+\.\d+\.\d+)|(?<combined_ipv6>.*)$"

Splitting field into 2 fields?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future

Join the Conversation