Splunk Search

Add entry data to an alert

mwcentracomm
Explorer

I am using the search below

| metadata type=hosts | where recentTime < now() - 10800| eval lastSeen = strftime(recentTime, "%F %T") | fields + host lastSeen

 

I would like to add a field populated by somename that ends in "srx"

 

Jan 4 13:07:57 1.1.1.1 1 2024-01-04T13:07:57.085-05:00 5995-somename-srx rpd 2188 JTASK_SIGNAL_INFO [junos@2636.1.1.1.2.133 message-name="INFO Signal Info: Signal Number = " signal-number="1" name=" Consumed Count = " data-1="3"]

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use the eval command to add a field to your results.

| metadata type=hosts 
| where recentTime < now() - 10800| eval lastSeen = strftime(recentTime, "%F %T") 
| fields + host lastSeen
| eval newField="srx"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

mwcentracomm
Explorer

Sorry, I did not completely explain, - I would like it to return the full name ending in srx.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Only the fields provided by the metadata command can be displayed unless you add other commands that search indexes for names ending with "srx".  If the desired field *is* returned by metadata then include it in the fields command then use where or search to filter the desired values.

| metadata type=hosts 
| where recentTime < now() - 10800| eval lastSeen = strftime(recentTime, "%F %T") 
| fields + host lastSeen
| search host="*srx"

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...