topic Re: Change host name at search time in Getting Data In

Change host name at search time

hartfoml — Thu, 15 Nov 2012 21:26:28 GMT

I have a search like this

sourcetype=foo | stats count by host

I have 8 hosts that report to this search and all of them have standard names but one does not.

I get this type of results:

host     count
sys1     20
sys2     25
srv1     40

I want to change the results so that srv1 shows up in the results as sys3.

as always thanks for your help....:-)

Ayn — Thu, 15 Nov 2012 21:32:03 GMT

Just rewrite the host value in your search before the stats command.

sourcetype=foo | eval host=if(host=="srv1","sys3",host) | stats count by host

hartfoml — Thu, 15 Nov 2012 21:41:37 GMT

thanks much