Splunk Search

Replace host IP address with Name

cshewalkar
Engager

Hi Team, 

Need some help, while running below query I get host IP i.e. 10.65.x.x in Number display visualization but I need to replace with name "xyz"

index=network ((host=10.65.x.x) AND ((Interface Ethernet1/50 is *) OR (Interface Ethernet1/49 is *) OR (Interface Ethernet1/3 is *))) | table message_text, host


Attached is the screenshot

Can you assist me what needs to be done to solve this issue.

Capt.PNG

Labels (1)
0 Karma
1 Solution

kiran_panchavat
SplunkTrust
SplunkTrust

@cshewalkar 

Are you looking to change the host value? You can change the value using replace command. 

https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Replace 

kiran_panchavat_0-1735814354620.pngkiran_panchavat_1-1735814374576.png

I hope this helps, if any reply helps you, you could add your upvote/karma points to that reply, thanks.

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Does Splunk already know what host name has to be replaced for each ip address? For example, are there some other events, or even the same events, which hold this relationship, or do you have a lookup holding this information?

0 Karma

kiran_panchavat
SplunkTrust
SplunkTrust

@cshewalkar 

Are you looking to change the host value? You can change the value using replace command. 

https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Replace 

kiran_panchavat_0-1735814354620.pngkiran_panchavat_1-1735814374576.png

I hope this helps, if any reply helps you, you could add your upvote/karma points to that reply, thanks.

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma

cshewalkar
Engager

Hi Kiran,

Thanks.

Replace values in an internal field - has solve the problem.

0 Karma

kiran_panchavat
SplunkTrust
SplunkTrust

@cshewalkar 

Great man. Happy Splunking!

I hope this helps. If any reply helps you, you could add your upvote/karma points to that reply.

Did this help? If yes, please consider giving kudos, marking it as the solution, or commenting for clarification — your feedback keeps the community going!
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...