I wanted to create a new field name like 'Country' from the incoming logs based on some characters in the hostname.
Timestamp Type Hostname Service Status Fri Mar 14 11:16:16 2014 $ SERVICEALERT $ AU_DC_1 $ SERVICE1 $ OK Fri Mar 14 11:17:11 2014 $ HOSTALERT $ IN_DC_2 $ SERVICE2 $ WARNING Fri Mar 14 11:18:12 2014 $ HOSTEALERT $ SG_DC_1 $ SERVICE3 $ OK
From the above logs from the HOSTNAME (
AU_DC,IN_DC,SG_DC) represents Country (
I wanted to create a new fields with this how can create it ?
i tried to tag this , but each time the HOSTNAME may differ , is there any eval commands help?
You want to add new field, say country with values AU/IN/SG or Australia/India/Singapore? If first, then you just need field extraction (using rex/props.conf). If second, then you need field extraction and lookups both.
I think you could use Lookups for this. If you have a large list, I think lookups would be the better option for you.
You could do a static lookup. You'd have to make the CSV list of all the hostnames and the country they are associated with, but it would provide you with the data you are looking for and create the Country field automatically.
To test it you could start off with just a small list.
This is also a great blog on how this works. The example is very similar to what you are trying to do.
If there only three specfic hosts as you say to can use the eval statment like this in your search
[your search ] | eval NEWHOSTNAME=case(hostname==AUDC,"Australia",hostname==INDC,"India",hostname==SD_DC,"Singapore")
or if the no of hostnames are more you can use lookup .pls refer
Hope this helps !