topic Re: Replace host IP address with Name in Splunk Search

Replace host IP address with Name

cshewalkar — Thu, 02 Jan 2025 15:08:57 GMT

Hi Team,

Need some help, while running below query I get host IP i.e. 10.65.x.x in Number display visualization but I need to replace with name "xyz"

index=network ((host=10.65.x.x) AND ((Interface Ethernet1/50 is *) OR (Interface Ethernet1/49 is *) OR (Interface Ethernet1/3 is *))) | table message_text, host

Attached is the screenshot

Can you assist me what needs to be done to solve this issue.

Re: Replace host IP address with Name

kiran_panchavat — Thu, 02 Jan 2025 10:40:43 GMT

@cshewalkar

Are you looking to change the host value? You can change the value using replace command.

https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Replace

I hope this helps, if any reply helps you, you could add your upvote/karma points to that reply, thanks.

Re: Replace host IP address with Name

ITWhisperer — Thu, 02 Jan 2025 11:34:02 GMT

Does Splunk already know what host name has to be replaced for each ip address? For example, are there some other events, or even the same events, which hold this relationship, or do you have a lookup holding this information?

Re: Replace host IP address with Name

cshewalkar — Thu, 02 Jan 2025 11:56:31 GMT

Hi Kiran,

Thanks.

Replace values in an internal field - has solve the problem.

Re: Replace host IP address with Name

kiran_panchavat — Thu, 02 Jan 2025 16:00:37 GMT

@cshewalkar

Great man. Happy Splunking!

I hope this helps. If any reply helps you, you could add your upvote/karma points to that reply.