Splunk Search
Highlighted

How to edit my search to count the number of servers?

New Member

We have Multiple servers that all end with the same few letters like this.

Office1Server
Office2Server
Remot1Server
Remot2Server
Remot3Server

I want to return results that look like this

OfficeServer 10
RemotServer 23

index=stuff* host=*SERVER "Deployed successfully" | cluster t=0.35 field=host

Is that possible and if so, what do I change my search to?

0 Karma
Highlighted

Re: How to edit my search to count the number of servers?

Champion

Using cluster is likely going to give you an indeterminate result. Instead, you can create a new field by ripping out the numbers and then get the counts.

Try this.

index=stuff* host=*SERVER "Deployed successfully" 
| eval newhost = replace(host, "(\D+)(\d+)(\D+)","\1\3") 
| stats count by newhost
0 Karma
Highlighted

Re: How to edit my search to count the number of servers?

Super Champion

if they all end with "Server", you could adding something like:

|rex field=host mode=sed "/s/\d+Server/Server/" 
0 Karma