I have hundreds of hosts within a tier and would like to combine those hosts for the purposes of reporting. For example, I have the following hosts:
web001.mydomain.com
web002
web003
web004
...
web999
I'd like to report all web hosts as web_tier. So I can run a report for users who access hosts in the web_tier. How can I do this?
Hi
We have a DB that stores this type of information at our company and we use lookups to add that kind of information to our events.
I guess you could try this eval, and use the tier field for your report:
| eval tier=replace(source,"\d\d\d","_tier")
But I'm guessing that this is probably not what you're looking for.
Chris
Hi
We have a DB that stores this type of information at our company and we use lookups to add that kind of information to our events.
I guess you could try this eval, and use the tier field for your report:
| eval tier=replace(source,"\d\d\d","_tier")
But I'm guessing that this is probably not what you're looking for.
Chris
Another way to do this: ... | replace web* with web_tier in host | ...
I'm glad if that helped
Yes, Chris! This is what I needed! I used the following syntax to match multiple patterns:
| eval tier=replace(host,"(\d\d\d.mydomain.com|\d+.sub.mydomain.com)","_tier")