How can I rename the host names for my chart?

The replace command allows you to rename values in the search results. For example, let us assume you have the following search which produces a chart of error counts by host:

index=webserver sourcetype=syslog ERRORS | timechart count by host

This chart produces the correct output, but you want to alter the host names. This is because they are a very long string and you do not need the fully qualified domain. For example:

host1 = machine1-webserverpool1.subdomain.domain.com host2 = machine2-webserverpool2.subdomain.domain.com

Let's assume I want to rename host1 and host2 to be m1pool1 and m2pool2. You can simply add the following replace command before the timechart:

replace machine1-webserverpool1.subdomain.domain.com with m1pool1, machine2-webserverpool2.subdomain.domain.com with m2pool2 in host

You must make sure you specify the "in host" at the end, which tells Splunk to replace the values within the host field. The final search would be:

index=webserver sourcetype=syslog ERRORS | replace machine1-webserverpool1.subdomain.domain.com with m1pool1, machine2-webserverpool2.subdomain.domain.com with m2pool2 in host | timechart count by host

Alternatively, you could use the rex command in combination with a regex to extract only the portion you want to see. Let's assume I want to completely remove the subdomain and only see the node name. The rex portion might look like:

rex field=host "(?<hostname>.*).subdomain" 

The final search would be:

index=webserver sourcetype=syslog ERRORS |  rex field=host "(?<hostname>.*).subdomain" | timechart count by host

The output of this search would show counts for machine1-web-serverpool1 and machine2-web-serverpool2.