topic Re: Filter data from result in Splunk Search

how to Filter data from result?

Akmal57 — Mon, 28 Aug 2023 18:50:31 GMT

We have a set of data which populate host and ip

Eg.

Host IP count

ESDBAS 10.10.10.10 1

ASFDB 192.0.0.0 1

Query:

index=a sourcetype=b
| stats values(ip) as IP count by host

i need the result which any hostname that contain DB should come out on another field

eg:

Host IP count Environment

ESDBAS 10.10.10.10 1 DB

ASFDB 192.0.0.0 1 DB

Please assist me on this

gcusello — Mon, 28 Aug 2023 07:24:00 GMT

let me understand: you want also to count the occurrences of the word "DB" in the hostnames?

If this is your requirement, you have two solutions:

you could use the rex command before the stats, somehing like this:

index=a sourcetype=b | rex field=host "(?<Environment>DB)" | stats values(ip) AS IP values(Environment) AS Environment count BY host

or the eval command:

index=a sourcetype=b | eval Environment=if(match(host,"DB"),"DB","") | stats values(ip) AS IP values(Environment) AS Environment count BY host

Ciao.

Giuseppe

Akmal57 — Tue, 29 Aug 2023 02:41:31 GMT

Thank you very much for your assist.

What you understand is correct, both of your query works perfectly fine as expected.