topic Re: How to separate a search by groups of hosts? in Splunk Search

How to separate a search by groups of hosts?

meleschi — Mon, 24 Apr 2017 20:21:16 GMT

Hello!

If I run this query, I'll get a graph of the # of queries over time aggregated for all of my hosts.

host=* | timechart per_minute(Query)

If I run this query, I'll have a similar graph with one line shown per host.

host=* | timechart per_minute(Query) by host

Is there any way to graph by groups of hosts? Say, by the domain of the server.

example:

host=* | timechart per_minute(Query) by group (a, b, c) where group a like "*.a.com" and group b like "*.b.com" and group c like "*.c.com"

Re: How to separate a search by groups of hosts?

lycollicott — Mon, 24 Apr 2017 20:25:53 GMT

Off the top of my head, I would extract a field to be the domain and group by that.

So, something like:

hosts=* 
| rex field=host "\.(?\w+\.\w+)"
| timechart span=1m count by domain_name

Re: How to separate a search by groups of hosts?

somesoni2 — Mon, 24 Apr 2017 20:37:32 GMT

You can create a field with those criteria/specification and they group by those.
e.g.

 host=* | eval group=case(like(host,"%.a.com"),"group a",like(host,"%.b.com"),"group b",...other sets here, 1=1,"defauly") | timechart per_minute(Query) by group

If you're only interested in group a/b/c (you don't want to statistics for other domains, add them as filter in the base search.

 host=*.a.com OR host=*.b.com OR host=*.c.com  | eval group=case(like(host,"%.a.com"),"group a",like(host,"%.b.com"),"group b",...other sets here, 1=1,"defauly") | timechart per_minute(Query) by group

Re: How to separate a search by groups of hosts?

meleschi — Fri, 22 Nov 2019 22:05:38 GMT

Thank you for both answers above. I ended up placing some data in a lookup table, and using that to break apart servers by region, type, etc.

Re: How to separate a search by groups of hosts?

woodcock — Sat, 23 Nov 2019 06:38:10 GMT

Like this:

 host=*
| rex field=host mode=sed "s/^[^\.]+/\*/"
| timechart per_minute(Query) BY host