Splunk Search

Changing the Name of Results

henryt1
Path Finder

Hi,

I recently started using Splunk and searched for the answer to this but was unable to find it. I am trying to change the name of some of my search results. For instance, I am running the following search:

host="web01.inno-360.com" AND source="/var/log/apache2/pg_ssl_access.log" OR source="/var/log/apache2/disney_ssl_access.log" OR source="/var/log/apache2/afrl_ssl_access.log" OR source="/var/log/apache2/genmills_ssl_access.log" OR source="/var/log/apache2/mwv_ssl_access.log" OR source="/var/log/apache2/lmco_ssl_access.log" OR source="/var/log/apache2/givaudan_ssl_access.log" AND /users/login | stats count by source | RENAME source AS "Client Instance", count AS "Number of Logins"

The results I get back are fine, it has the file path listed under one column and the number I need for the other. However, when I go to create a graph, you are not able to read it fully because the file path is so long. So my question is, can I change that?

Ideally I would like to take the result for 'source="/var/log/apache2/lmco_ssl_access.log"' and change it to just LMCO so that it is readable in the graph.

Any help on this would be great!

-Tyler

Tags (4)
0 Karma

henryt1
Path Finder

Great! That worked, now the name is listed as 'mwv_ssl_access.log'. What would be the regex to extract just 'MWV' out of 'mwv_ssl_access.log'?

0 Karma

henryt1
Path Finder

So I just added to the script:

host="web01.inno-360.com" AND source="/var/log/apache2/pg_ssl_access.log" OR source="/var/log/apache2/disney_ssl_access.log" OR source="/var/log/apache2/afrl_ssl_access.log" OR source="/var/log/apache2/genmills_ssl_access.log" OR source="/var/log/apache2/mwv_ssl_access.log" OR source="/var/log/apache2/lmco_ssl_access.log" OR source="/var/log/apache2/givaudan_ssl_access.log" AND /users/login | stats count by source | rex field=source "/(?[^/]+)$"

Now the results come back with the source_short column which is fine but when I go to create a graph I only want the 'source_short' field and not the 'source' field (which it is giving me).

0 Karma

Ayn
Legend

Rename the field first of all and then do your stats count by the source_short field instead.

host="web01.inno-360.com" AND source="/var/log/apache2/pg_ssl_access.log" OR source="/var/log/apache2/disney_ssl_access.log" OR source="/var/log/apache2/afrl_ssl_access.log" OR source="/var/log/apache2/genmills_ssl_access.log" OR source="/var/log/apache2/mwv_ssl_access.log" OR source="/var/log/apache2/lmco_ssl_access.log" OR source="/var/log/apache2/givaudan_ssl_access.log" AND /users/login | rex field=source "/(?<source_short>[^/]+)$" | stats count by source_short

0 Karma

Ayn
Legend

Have a look at this q/a that deals with this exact matter. http://splunk-base.splunk.com/answers/43456/rename-source-in-chart

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...