Splunk Search

Add entry data to an alert

mwcentracomm
Explorer

I am using the search below

| metadata type=hosts | where recentTime < now() - 10800| eval lastSeen = strftime(recentTime, "%F %T") | fields + host lastSeen

 

I would like to add a field populated by somename that ends in "srx"

 

Jan 4 13:07:57 1.1.1.1 1 2024-01-04T13:07:57.085-05:00 5995-somename-srx rpd 2188 JTASK_SIGNAL_INFO [junos@2636.1.1.1.2.133 message-name="INFO Signal Info: Signal Number = " signal-number="1" name=" Consumed Count = " data-1="3"]

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use the eval command to add a field to your results.

| metadata type=hosts 
| where recentTime < now() - 10800| eval lastSeen = strftime(recentTime, "%F %T") 
| fields + host lastSeen
| eval newField="srx"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

mwcentracomm
Explorer

Sorry, I did not completely explain, - I would like it to return the full name ending in srx.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Only the fields provided by the metadata command can be displayed unless you add other commands that search indexes for names ending with "srx".  If the desired field *is* returned by metadata then include it in the fields command then use where or search to filter the desired values.

| metadata type=hosts 
| where recentTime < now() - 10800| eval lastSeen = strftime(recentTime, "%F %T") 
| fields + host lastSeen
| search host="*srx"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...