Splunk Search

How to modify search result?

Akmal57
Path Finder

I have asset management data that i need to create weekly reports.

When i make query for the data like query below:

index=a sourcetype=b

stats values(ip_addr) as ip by hostname

Result:

hostname        ip

Host A            1) 10.0.0.0

                          2) 10.10.10.1

                          3) 10.0.0.2

Host B            1) 192.1.1.1

                          2) 172.1.1.1

i wanted the result not include the numbering in front of the ip address.

Please assist on this. Thank you.

Labels (3)
Tags (2)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Akmal57 

I think you should remove numbering before stats. Can you please try this?

 

YOUR SEARCH
|rex field=ip_addr "(?<ip>\d+\.\d+\.\d+\.\d+)"
|stats values(ip) as ip by hostname

 

 

My Sample Search :

 

| makeresults 
| eval _raw="hostname,ip_addr
Host A,1) 10.0.0.0
Host A,2) 10.10.10.1
Host A,3) 10.0.0.2
Host B,1) 192.1.1.1
Host B,2) 172.1.1.1" 
| multikv forceheader=1
| table hostname,ip_addr
|rex field=ip_addr "(?<ip>\d+\.\d+\.\d+\.\d+)"
|stats values(ip) as ip by hostname

 

 

 

Screenshot 2023-09-11 at 10.25.08 AM.png

 

I hope this will help you.

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

View solution in original post

kamlesh_vaghela
SplunkTrust
SplunkTrust

@Akmal57 

I think you should remove numbering before stats. Can you please try this?

 

YOUR SEARCH
|rex field=ip_addr "(?<ip>\d+\.\d+\.\d+\.\d+)"
|stats values(ip) as ip by hostname

 

 

My Sample Search :

 

| makeresults 
| eval _raw="hostname,ip_addr
Host A,1) 10.0.0.0
Host A,2) 10.10.10.1
Host A,3) 10.0.0.2
Host B,1) 192.1.1.1
Host B,2) 172.1.1.1" 
| multikv forceheader=1
| table hostname,ip_addr
|rex field=ip_addr "(?<ip>\d+\.\d+\.\d+\.\d+)"
|stats values(ip) as ip by hostname

 

 

 

Screenshot 2023-09-11 at 10.25.08 AM.png

 

I hope this will help you.

Thanks
KV
If any of my replies help you to solve the problem Or gain knowledge, an upvote would be appreciated.

Akmal57
Path Finder

Hi @kamlesh_vaghela, its work as expected. Thank you very much for your assist.

0 Karma
Get Updates on the Splunk Community!

Splunk is Nurturing Tomorrow’s Cybersecurity Leaders Today

Meet Carol Wright. She leads the Splunk Academic Alliance program at Splunk. The Splunk Academic Alliance ...

Part 2: A Guide to Maximizing Splunk IT Service Intelligence

Welcome to the second segment of our guide. In Part 1, we covered the essentials of getting started with ITSI ...

Part 1: A Guide to Maximizing Splunk IT Service Intelligence

As modern IT environments continue to grow in complexity and speed, the ability to efficiently manage and ...