topic Re: Agent version grouping by OS in Knowledge Management

Agent version grouping by OS

jcorcoran508 — Wed, 30 Jun 2021 13:41:59 GMT

I have many agent versions and each row is displayed as the different version... Like the query is telling it to do.

I need help in the sense of would like to truncate evey period and digit to the single version digit.

6.3.0.0

6.2.1

7.3.3

7.21

To look like this:

Re: Agent version grouping by OS

richgalloway — Wed, 30 Jun 2021 14:27:15 GMT

There are a few ways to do that. Here's one

| rex field=version "(?<version>\d+)\."

Re: Agent version grouping by OS

aasabatini — Wed, 30 Jun 2021 14:30:41 GMT

Hi @jcorcoran508

you can use substr eval function

| eval version=substr(version,1,1)

useful search:

index=_internal sourcetype=splunkd group=tcpin_connections version=* os=* arch=* build=* hostname=* source=*metrics.log | stats latest(version) as version,latest(arch) as arch,latest(os) as os,latest(build) as build by hostname | eval version=substr(version,1,1) | join hostname [ | metadata type=hosts index=* | eval last_seen_hours=(now()-lastTime)/60/60 | table host, last_seen_hours | rex field=host "(?<hostname>[^\.]+)" | fields - host ]

Regards

Ale