Team,
We have 3 different sourcetype on which endpoint/device are identified by different fieldname:
sourcetype=x endpoint identified by the field $host$ , sourcetype=y identified by $fqdn$ and sourcetype=z identified by $dns$
I want to bind all the devices to sourcetype , by renaming all the device field renamed to common field name $endpoint$. How to go over this?
host1 hos2 | stats count by sourcetype endpoint
Try,
"your base search"|eval endpoint=case(sourcetype=="x",host,sourcetype=="y",fqdn,sourcetype=="z",dns)|stats count by sourcetype,endpoint
Try,
"your base search"|eval endpoint=case(sourcetype=="x",host,sourcetype=="y",fqdn,sourcetype=="z",dns)|stats count by sourcetype,endpoint
Thanks !
host* - is the search string i used which mapped to host
field host=host1 , host=host2 host=3
but host like client1 client2 which are present in log message for the host are also populating in the search with host=client1 host=client2 host=client3
How can i exclude host=client* ? using eval
(host=host* AND host!=client* )
Thanks Renjith . But i used the below query which is time consuming.
"your base search"|eval endpoint=case(sourcetype=="x",host,sourcetype=="y",fqdn,sourcetype=="z",dns)|search endpoint=host* | stats count by sourcetype,endpoint
I have used the new field name to filter out events.