Replace host IP address with Name

[cshewalkar]

Hi Team, 

Need some help, while running below query I get host IP i.e. 10.65.x.x in Number display visualization but I need to replace with name "xyz"

index=network ((host=10.65.x.x) AND ((Interface Ethernet1/50 is *) OR (Interface Ethernet1/49 is *) OR (Interface Ethernet1/3 is *))) | table message_text, host

Attached is the screenshot

Can you assist me what needs to be done to solve this issue.

[ITWhisperer]

Does Splunk already know what host name has to be replaced for each ip address? For example, are there some other events, or even the same events, which hold this relationship, or do you have a lookup holding this information?

[kiran_panchavat · Accepted solution]

@cshewalkar 

Are you looking to change the host value? You can change the value using replace command. 

https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/Replace 

I hope this helps, if any reply helps you, you could add your upvote/karma points to that reply, thanks.

[cshewalkar]

Hi Kiran,

Thanks.

Replace values in an internal field - has solve the problem.

[kiran_panchavat]

@cshewalkar 

Great man. Happy Splunking!

I hope this helps. If any reply helps you, you could add your upvote/karma points to that reply.