We have a set of data which populate host and ip
Eg.
Host IP count
ESDBAS 10.10.10.10 1
ASFDB 192.0.0.0 1
Query:
index=a sourcetype=b
| stats values(ip) as IP count by host
i need the result which any hostname that contain DB should come out on another field
eg:
Host IP count Environment
ESDBAS 10.10.10.10 1 DB
ASFDB 192.0.0.0 1 DB
Please assist me on this
Hi @Akmal57,
let me understand: you want also to count the occurrences of the word "DB" in the hostnames?
If this is your requirement, you have two solutions:
you could use the rex command before the stats, somehing like this:
index=a sourcetype=b
| rex field=host "(?<Environment>DB)"
| stats values(ip) AS IP values(Environment) AS Environment count BY host
or the eval command:
index=a sourcetype=b
| eval Environment=if(match(host,"DB"),"DB","")
| stats values(ip) AS IP values(Environment) AS Environment count BY host
Ciao.
Giuseppe
Hi @Akmal57,
let me understand: you want also to count the occurrences of the word "DB" in the hostnames?
If this is your requirement, you have two solutions:
you could use the rex command before the stats, somehing like this:
index=a sourcetype=b
| rex field=host "(?<Environment>DB)"
| stats values(ip) AS IP values(Environment) AS Environment count BY host
or the eval command:
index=a sourcetype=b
| eval Environment=if(match(host,"DB"),"DB","")
| stats values(ip) AS IP values(Environment) AS Environment count BY host
Ciao.
Giuseppe
Hi @gcusello ,
Thank you very much for your assist.
What you understand is correct, both of your query works perfectly fine as expected.