I am trying to filtering results based on hosts which are our hbase zookeepers and region servers. There are 3 hbase clusters overall
Cluster1
test101
test102
test103
..
test116
Cluster2
test117
test118
..
test125
Cluster3
test126
..
test138
is it possible to filter these three clusters by regex by something like this. This is what i currently have to filter the first cluster it doesn't seem to be working.
host="test"|regex_raw="\b0[1]1[0-1]2[0-9]\b"
I see two alternatives to regex-based filtering: You could either tag your hosts with cluster1, cluster2, and cluster3, or you could have a numeric field from 101 to 138 and filter using arithmetic comparators, ie cluster1 would be hostnumber>=101 AND hostnumber<=116. In fact, you can use the comparison operators with string ordering, but I'm not certain how efficient this would be: host>="test101" AND host<="test116"
Tagging likely is the most efficient way, and the splunkiest.
I see two alternatives to regex-based filtering: You could either tag your hosts with cluster1, cluster2, and cluster3, or you could have a numeric field from 101 to 138 and filter using arithmetic comparators, ie cluster1 would be hostnumber>=101 AND hostnumber<=116. In fact, you can use the comparison operators with string ordering, but I'm not certain how efficient this would be: host>="test101" AND host<="test116"
Tagging likely is the most efficient way, and the splunkiest.
that is so sweet!
i think ideal way might be filtering by specifying range like for cluster1 host="test"|"101-116", cluster2 host="test"|"117-125" not sure how to go about to get this.