I have a chart that graphs by hostnames, but I don't want to see the fully qualified domain of each host. How could I rename the host values to be a subset of the name or a completely different name?
asked 21 Sep '10, 19:39
The replace command allows you to rename values in the search results. For example, let us assume you have the following search which produces a chart of error counts by host:
This chart produces the correct output, but you want to alter the host names. This is because they are a very long string and you do not need the fully qualified domain. For example:
host1 = machine1-webserverpool1.subdomain.domain.com host2 = machine2-webserverpool2.subdomain.domain.com
Let's assume I want to rename host1 and host2 to be m1pool1 and m2pool2. You can simply add the following replace command before the timechart:
You must make sure you specify the "in host" at the end, which tells Splunk to replace the values within the host field. The final search would be:
Alternatively, you could use the rex command in combination with a regex to extract only the portion you want to see. Let's assume I want to completely remove the subdomain and only see the node name. The rex portion might look like:
The final search would be:
The output of this search would show counts for machine1-web-serverpool1 and machine2-web-serverpool2.
You can use
answered 21 Sep '10, 19:49
You can use the
see my answer to a different question over here -- http://answers.splunk.com/questions/6424/replace-parts-of-a-string/6430#6430
answered 21 Sep '10, 19:46