Reporting

How to group hosts for reporting?

Champion

I have hundreds of hosts within a tier and would like to combine those hosts for the purposes of reporting. For example, I have the following hosts:

web001.mydomain.com
web002
web003
web004
...
web999

I'd like to report all web hosts as web_tier. So I can run a report for users who access hosts in the web_tier. How can I do this?

0 Karma
1 Solution

Motivator

Hi

We have a DB that stores this type of information at our company and we use lookups to add that kind of information to our events.

I guess you could try this eval, and use the tier field for your report:

| eval tier=replace(source,"\d\d\d","_tier")

But I'm guessing that this is probably not what you're looking for.

Chris

View solution in original post

Motivator

Hi

We have a DB that stores this type of information at our company and we use lookups to add that kind of information to our events.

I guess you could try this eval, and use the tier field for your report:

| eval tier=replace(source,"\d\d\d","_tier")

But I'm guessing that this is probably not what you're looking for.

Chris

View solution in original post

Splunk Employee
Splunk Employee

Another way to do this: ... | replace web* with web_tier in host | ...

Motivator

I'm glad if that helped

0 Karma

Champion

Yes, Chris! This is what I needed! I used the following syntax to match multiple patterns:

| eval tier=replace(host,"(\d\d\d.mydomain.com|\d+.sub.mydomain.com)","_tier")

0 Karma