Knowledge Management

Agent version grouping by OS

jcorcoran508
Path Finder

I have many agent versions and each row is displayed as the different version... Like the query is telling it to do.

 

I need help in the sense of  would like to truncate evey period and digit to the single version digit.

6.3.0.0

6.2.1

7.3.3

7.21

To look like this:

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

There are a few ways to do that.  Here's one

| rex field=version "(?<version>\d+)\."
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There are a few ways to do that.  Here's one

| rex field=version "(?<version>\d+)\."
---
If this reply helps you, Karma would be appreciated.
0 Karma

aasabatini
Motivator

Hi @jcorcoran508 

you can use substr eval function

| eval version=substr(version,1,1)

useful search:

index=_internal sourcetype=splunkd group=tcpin_connections version=* os=* arch=* build=* hostname=* source=*metrics.log
| stats latest(version) as version,latest(arch) as arch,latest(os) as os,latest(build) as build by hostname
| eval version=substr(version,1,1)
| join hostname [ | metadata type=hosts index=*
| eval last_seen_hours=(now()-lastTime)/60/60
| table host, last_seen_hours
| rex field=host "(?<hostname>[^\.]+)" | fields - host ]

 Regards

Ale

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...