How do I split a field in a pipeline?

I have a field that includes IP and Port (i.e. 0.0.0.0:1234) and I want to split them into separate fields for further analysis. What’s the best way to do that?

3 UpGoats

Use the Regex Extract function:

(?<ip>[^:]+):(?<port>\d+)
6 UpGoats

(the edit: button isn’t working for me? so making an expanded post)
One way would be to use the REGEX extract and for the REGEX use something similar to (?\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}):(?\d{1,5}) (there are other ways to do this obviously which are more strrict/validating, but this should do fine for most)

Also you could use a split function on eval.
name|value expression:
ipaddress | nameOfCombinedField.split(’:’)[0]
port | nameOfCombinedField.split(’:’)[1]

5 UpGoats

The Eval function was exactly what I needed.

2 UpGoats