Splunk Search

How can I remove additional field values?

chrisschum
Path Finder

I've tried several different ways to resolve this issue including using 'rex' and 'replace' but I can't seem to get it to work.

The dst field on log results comes out as "192.168.1.1:1234:ABCD-A123"

How can I just get the IP "192.168.1.1" and remove the other data?

Thanks!

0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

Are you trying to replace it at search time or index time?

This will remove it at search time
| rex mode=sed s/\d+\.\d+\.\d+\.\d+\S+/\d+\.\d+\.\d+\.\d+/g

This will remove it at index time
SEDCMD-remove = ...

View solution in original post

PowerPacked
Builder

Use this REX to extract only IP from it.

| rex field=_raw "(?P\d{0,3}.\d{0,3}.\d{0,3}.\d{0,3}):"

Thanks

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Are you trying to replace it at search time or index time?

This will remove it at search time
| rex mode=sed s/\d+\.\d+\.\d+\.\d+\S+/\d+\.\d+\.\d+\.\d+/g

This will remove it at index time
SEDCMD-remove = ...

chrisschum
Path Finder

This worked, thanks! And it was at search time.

One additional question I failed to mention. How can I pass this removal to the additional part of my search below? This removal doesn't appear to change the 'dst' field value with the list command piece, if that makes sense.

| stats count by dst, src | stats list(src), list(dst) by count

Thanks!

0 Karma

skoelpin
SplunkTrust
SplunkTrust

So what this is doing is it's finding a pattern and replacing it with just the IP. The rex mode=sed works like this

s/<Regex to find pattern>/<-Replace it with this pattern---->/g

So if you want to apply this to your dest field, you would have to pattern match it like the regex above. Or you can simply extract the the IP from that field and create a new field with it. Paste the pattern of your dest IP and source IP so I can see how they differ

0 Karma

chrisschum
Path Finder

Okay, that make sense, thanks!

I'll mess around with it and should be able to come up with what I need based on the information you gave me.

Thanks!

skoelpin
SplunkTrust
SplunkTrust

Don't forget to accept the answer when this solves your problem!

0 Karma

PowerPacked
Builder

Use this search

Your search | rex field=dst "(?P\d{0,3}.\d{0,3}.\d{0,3}.\d{0,3}):" | stats count by IP_Only

0 Karma

chrisschum
Path Finder

It's giving me an error message:
Error in 'rex' command: Encountered the following error while compiling the regex '(?P\d{0,3}.\d{0,3}.\d{0,3}.\d{0,3}):': Regex: unrecognized character after (?P

Thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...