identify server host names as developemnt or test by name

[Hudond]

Good afternoon

I have a question about identifying the type of environment the servers are in by their hostnames being extracted using the Microsoft-add on for splunk.

The server hostnames are being indexed as follows:

servername"DV"

servername"TV"

Servername"DV"serverName

Servername"TV"servername

So server names that have the DV and TV designations are identified as belonging to the development and test environments. Sometimes the characters are at the end and sometimes they are in the middle of the server names.

I am looking at running a search that will identify the hostname as being in the development or test environments and adding that as a column to the search results fro the hostnames.

If the hostname does not have those designations I would like to identify them as "other"

I would appreciate any guidance of the best approach to use for the search string, that way I can research it and learn how to do it.

Thank you

Dan

[jwrjrobertson05 · Accepted solution]

You'll want to use eval with CASE something like...

index=<something> field=<whatever>
| eval ENV = CASE ( hostname LIKE "%DV%","DV", hostname LIKE "%TV%","TV",hostname LIKE "%","OTH")
| stats count by ENV