grouping search results by hostname

[smudge797]

We need to group hosts by naming convention in search results so for example hostnames:
x80* = env1
y20* = prod
L* = test
etc..

Also can this be done by | tsats command?

[somesoni2]

Try something like this (sample tstats command, replace it with your own). The case statement works with regular expression and providing a partial regex will match any position.

| tstats count WHERE index=* by host | eval Environment=case(match(host,"x80"),"env1",match(host,"y20"),"prod",match(host,"L"),"test","ny","someotherenv",ture(),"OTHERE") | stats sum(count) as count by Environment

[sundareshr · Accepted solution]

Try this

... | eval env=case(match(host, "x80*), "env1", match(host, "y20*), "prod", match(host, "L*), "test", 1=1, "UNK") 

[smudge797]

Thanks, looking promising. seems to struggle with hosts matching names in the middle so like ny

[sundareshr]

This will look for hosts that start with x80 for eg. Not in the middle. Can you share some sample or mocked up hosts to adjust the match pattern

[smudge797]

ah the page does not like the wild cards. common is the ny between the wildcards * ny *
RAAG14*NY1234
RABHAG94NY1256
RACAG84NY1277
RADAGSS4NY1244
RAEAG14NY*9888

page keeps cutting my post, but i hope it makes sense..

[sundareshr]

So all hosts with the characters NY should be considered in the prod group?

[sundareshr]

Try these

match(host, "\*")

match(host, "NY")

[smudge797]

Thanks this is working well.