We have Multiple servers that all end with the same few letters like this.
Office1Server
Office2Server
Remot1Server
Remot2Server
Remot3Server
I want to return results that look like this
OfficeServer 10
RemotServer 23
index=stuff* host=*SERVER "Deployed successfully" | cluster t=0.35 field=host
Is that possible and if so, what do I change my search to?
if they all end with "Server", you could adding something like:
|rex field=host mode=sed "/s/\d+Server/Server/"
Using cluster
is likely going to give you an indeterminate result. Instead, you can create a new field by ripping out the numbers and then get the counts.
Try this.
index=stuff* host=*SERVER "Deployed successfully"
| eval newhost = replace(host, "(\D+)(\d+)(\D+)","\1\3")
| stats count by newhost