I have the below column whereby im pinging the url in the column, but for a nicer view I only want to display
the pc name eg "03131bipc142w" is this possible?
Hi @sphiwee,
if your request is how to modify a log in Splunk, the answer is: not possible on already indexed logs!
if your request is to modify the field uri displayed in the dashboard, you can use a regex to extract only the part of the field that you want, please try something like this:
your_search
| rex field=uri "http:\/\/(?<url>[^\.]+)"
| table url
that you can test at https://regex101.com/r/eekkf4/1
Ciao.
Giuseppe
Can you please try this?
YOUR_SEARCH
|rex field=url "(?<pc_name>[a-z0-9|-]+)\.[a-z0-9|-]+\.[a-z0-9|-]+\.[a-z]+"
My Sample Search :
| makeresults | eval url="http://030313bipc142w.za.sbicdirectory.com:4444/grid/console"
|rex field=url "(?<pc_name>[a-z0-9|-]+)\.[a-z0-9|-]+\.[a-z0-9|-]+\.[a-z]+"
Thanks
KV
▄︻̷̿┻̿═━一
If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
Hi @sphiwee,
if your request is how to modify a log in Splunk, the answer is: not possible on already indexed logs!
if your request is to modify the field uri displayed in the dashboard, you can use a regex to extract only the part of the field that you want, please try something like this:
your_search
| rex field=uri "http:\/\/(?<url>[^\.]+)"
| table url
that you can test at https://regex101.com/r/eekkf4/1
Ciao.
Giuseppe