Splunk Search

How to extract multiple values (IP addresses) into one field?

rubeniturrieta
Communicator

Hi to everyone,

If I have this data, a lot of IPs, how can I extract multiple values for a field? (For a config file, not search) For example:

Ip_address=10.1.144.80, 10.1.148.183, etc.

{
10.1.144.80
10.1.148.183
10.20.213.111
10.26.154.46
10.26.158.154
10.26.158.176
10.70.39.4
10.26.158.177
10.76.0.60
10.76.0.71
10.1.144.58
10.76.22.69
10.76.0.58
10.26.194.100
10.76.0.44
10.76.0.56
10.76.24.118
}

I'll be grateful for your help

Regards

0 Karma
1 Solution

aljohnson_splun
Splunk Employee
Splunk Employee

Permanently

Use MV_ADD=true. Read more here.

Or you could use fields.conf or check out this answer using props.conf & transforms.conf.


Via Search Commands

Just add this to your search:

... | rex "([[ipv4]])" | makemv ip

Or, if your ip is already extracted as Ip_address, you can make it multivalued with makemv:

... | makemv Ip_address

View solution in original post

aljohnson_splun
Splunk Employee
Splunk Employee

Permanently

Use MV_ADD=true. Read more here.

Or you could use fields.conf or check out this answer using props.conf & transforms.conf.


Via Search Commands

Just add this to your search:

... | rex "([[ipv4]])" | makemv ip

Or, if your ip is already extracted as Ip_address, you can make it multivalued with makemv:

... | makemv Ip_address

martin_mueller
SplunkTrust
SplunkTrust

Nitpicking: The "Permanently" approach is also search-time 😛

aljohnson_splun
Splunk Employee
Splunk Employee

You are right. Edited.

0 Karma

theeansible
Path Finder

WOW i didn't know about

| rex "([[ipv4]])"

Is there a list somewhere with all other regexes that ship with splunk?

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

@theeansible check transforms.conf

At the bottom, you'll see

###### BASIC MODULAR REGULAR EXPRESSIONS DEFINITION START ###########

🙂

0 Karma

rubeniturrieta
Communicator

Thanks you aljohnson, but i need it for a permanent extraction, not in the search.

0 Karma

aljohnson_splun
Splunk Employee
Splunk Employee

I see. I edited my answer to reference permanent extractions.

0 Karma

rubeniturrieta
Communicator

Thanks you very much

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...