Knowledge Management

Agent version grouping by OS

jcorcoran508
Path Finder

I have many agent versions and each row is displayed as the different version... Like the query is telling it to do.

 

I need help in the sense of  would like to truncate evey period and digit to the single version digit.

6.3.0.0

6.2.1

7.3.3

7.21

To look like this:

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

There are a few ways to do that.  Here's one

| rex field=version "(?<version>\d+)\."
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There are a few ways to do that.  Here's one

| rex field=version "(?<version>\d+)\."
---
If this reply helps you, Karma would be appreciated.
0 Karma

aasabatini
Motivator

Hi @jcorcoran508 

you can use substr eval function

| eval version=substr(version,1,1)

useful search:

index=_internal sourcetype=splunkd group=tcpin_connections version=* os=* arch=* build=* hostname=* source=*metrics.log
| stats latest(version) as version,latest(arch) as arch,latest(os) as os,latest(build) as build by hostname
| eval version=substr(version,1,1)
| join hostname [ | metadata type=hosts index=*
| eval last_seen_hours=(now()-lastTime)/60/60
| table host, last_seen_hours
| rex field=host "(?<hostname>[^\.]+)" | fields - host ]

 Regards

Ale

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...