Skip to main content
Solved

Re-write host field for Splunk

  • March 11, 2025
  • 1 reply
  • 87 views

Hello, this is probably simple, but I can’t get it to work. I just want to remove IPV6 encapsulation from the host field of events arriving at Cribl via syslog. So, existing host field is ::ffff:10.1.1.1, I want it to be just 10.1.1.1. For some reason I can’t get this to work, Splunk shows a null value for host when I try to EVAL, MASK, REGEX, etc. Anyone have a way to do this?

Best answer by Chris

Here is how I was able to do it. In my example, I have host set to your example above:

209_dbd770170fa34f53ada879c38d4cb1fc.png

Then I use the Regex Extract function to extract out the ipv4 address from host:
Regex is ^(?:[^\d]+)(?<host_regex>.+)$

209_f37b25ce17a242b9a893c04243f5b1a2.png

Then I use an Eval function to replace the host value with the host_regex value and then remove the host_regex field.

209_74e23e6ae4564a53a2e1e654e8745182.png

    1 reply

    • Chris
    • Employee
    • Answer
    • March 11, 2025

    Here is how I was able to do it. In my example, I have host set to your example above:

    209_dbd770170fa34f53ada879c38d4cb1fc.png

    Then I use the Regex Extract function to extract out the ipv4 address from host:
    Regex is ^(?:[^\d]+)(?<host_regex>.+)$

    209_f37b25ce17a242b9a893c04243f5b1a2.png

    Then I use an Eval function to replace the host value with the host_regex value and then remove the host_regex field.

    209_74e23e6ae4564a53a2e1e654e8745182.png
    Terms & ConditionsAccessibility statement