topic How to group hosts for reporting? in Reporting

How to group hosts for reporting?

the_wolverine — Wed, 10 Nov 2010 03:15:13 GMT

I have hundreds of hosts within a tier and would like to combine those hosts for the purposes of reporting. For example, I have the following hosts:

web001.mydomain.com
web002
web003
web004
...
web999

I'd like to report all web hosts as web_tier. So I can run a report for users who access hosts in the web_tier. How can I do this?

chris — Wed, 10 Nov 2010 04:10:11 GMT

We have a DB that stores this type of information at our company and we use lookups to add that kind of information to our events.

I guess you could try this eval, and use the tier field for your report:

| eval tier=replace(source,"\d\d\d","_tier")

But I'm guessing that this is probably not what you're looking for.

Chris

the_wolverine — Wed, 10 Nov 2010 15:48:30 GMT

Yes, Chris! This is what I needed! I used the following syntax to match multiple patterns:

| eval tier=replace(host,"(\d\d\d.mydomain.com|\d+.sub.mydomain.com)","_tier")

chris — Wed, 10 Nov 2010 18:39:17 GMT

I'm glad if that helped

araitz — Wed, 10 Nov 2010 23:54:22 GMT

Another way to do this: ... | replace web* with web_tier in host | ...