Knowledge Management

Agent version grouping by OS

jcorcoran508
Path Finder

I have many agent versions and each row is displayed as the different version... Like the query is telling it to do.

 

I need help in the sense of  would like to truncate evey period and digit to the single version digit.

6.3.0.0

6.2.1

7.3.3

7.21

To look like this:

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

There are a few ways to do that.  Here's one

| rex field=version "(?<version>\d+)\."
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There are a few ways to do that.  Here's one

| rex field=version "(?<version>\d+)\."
---
If this reply helps you, Karma would be appreciated.
0 Karma

aasabatini
Motivator

Hi @jcorcoran508 

you can use substr eval function

| eval version=substr(version,1,1)

useful search:

index=_internal sourcetype=splunkd group=tcpin_connections version=* os=* arch=* build=* hostname=* source=*metrics.log
| stats latest(version) as version,latest(arch) as arch,latest(os) as os,latest(build) as build by hostname
| eval version=substr(version,1,1)
| join hostname [ | metadata type=hosts index=*
| eval last_seen_hours=(now()-lastTime)/60/60
| table host, last_seen_hours
| rex field=host "(?<hostname>[^\.]+)" | fields - host ]

 Regards

Ale

“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...