Splunk Search

Hole in my "Bucket" - field value mixes Net_ID and computer names. Is it possible to split into computer bucket, Network ID bucket?

kkas
Path Finder

The sourceType I was told to mess with has a "Name" field. The field sometimes holds the value of a users Network ID like johnSmith, but other times it will have a computer_name like RUIOEFJ876V8$. computer_name always ends in a $ sign.

Is it possible to split these into two buckets when tabling my search?

I tried using the regex command, but I'm not sure how to implement it with buckets, so I wanted to check if anyone had any ideas with that way of solving the issue or if they had an opinion of a better way to solve it.

Tags (2)
0 Karma
1 Solution

woodcock
Esteemed Legend

Do it like this:

... | eval type=if(match(Name, ".*\$$"), "computer", "human") | stats count by host,type

View solution in original post

woodcock
Esteemed Legend

Do it like this:

... | eval type=if(match(Name, ".*\$$"), "computer", "human") | stats count by host,type
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...