how to Filter data from result?

[Akmal57]

We have a set of data which populate host and ip

Eg.

Host                  IP                            count

ESDBAS         10.10.10.10              1

ASFDB             192.0.0.0                   1

Query:

index=a  sourcetype=b
| stats values(ip) as IP count by host

i need the result which any hostname that contain DB should come out on another field

eg:

Host                  IP                            count      Environment

ESDBAS         10.10.10.10              1                      DB

ASFDB             192.0.0.0                   1                      DB

Please assist me on this

[gcusello · Accepted solution]

Hi @Akmal57,

let me understand: you want also to count the occurrences of the word "DB" in the hostnames?

If this is your requirement, you have two solutions:

you could use the rex command before the stats, somehing like this:

index=a sourcetype=b
| rex field=host "(?<Environment>DB)"
| stats values(ip) AS IP values(Environment) AS Environment count BY host

or the eval command:

index=a sourcetype=b
| eval Environment=if(match(host,"DB"),"DB","")
| stats values(ip) AS IP values(Environment) AS Environment count BY host

Ciao.

Giuseppe

[Akmal57]

Hi @gcusello , 

Thank you very much for your assist.

What you understand is correct, both of your query works perfectly fine as expected.