topic Re: edit fields in Splunk Search

edit fields

sphiwee — Thu, 01 Jul 2021 16:28:28 GMT

I have the below column whereby im pinging the url in the column, but for a nicer view I only want to display

the pc name eg "03131bipc142w" is this possible?

Re: edit fields

gcusello — Thu, 01 Jul 2021 16:40:54 GMT

if your request is how to modify a log in Splunk, the answer is: not possible on already indexed logs!

if your request is to modify the field uri displayed in the dashboard, you can use a regex to extract only the part of the field that you want, please try something like this:

your_search | rex field=uri "http:\/\/(?<url>[^\.]+)" | table url

that you can test at https://regex101.com/r/eekkf4/1

Ciao.

Giuseppe

Re: edit fields

kamlesh_vaghela — Thu, 01 Jul 2021 16:41:15 GMT

@sphiwee

Can you please try this?

YOUR_SEARCH |rex field=url "(?<pc_name>[a-z0-9|-]+)\.[a-z0-9|-]+\.[a-z0-9|-]+\.[a-z]+"

My Sample Search :

| makeresults | eval url="http://030313bipc142w.za.sbicdirectory.com:4444/grid/console" |rex field=url "(?<pc_name>[a-z0-9|-]+)\.[a-z0-9|-]+\.[a-z0-9|-]+\.[a-z]+"

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.