Filtering for certain Hostname in Lens

Been trying to figure out something that I thought would be simple but yet I can't seem to get it to work. I'm working on a lens with y axis is cpu percentage and x axis is host.name. I need it to only return a group of servers whos names start with NDHAHIWEB. I assumed changing hostname:* to host.name:NDHAHIWEB* would be the solution but it doesn't seem to work. How would I do this?

I assumed changing hostname:* to host.name:NDHAHIWEB* would be the solution but it doesn't seem to work

Where did you change this? If you enter it into the KQL bar on top, it should to exactly what you expect:

If you want to configure this filter as a filter pill, then you can't use the "is" operator, because it won't resolve wildcards. It's still possible, but you have to enter the query as JSON because there's no UI for this case. Click the "Edit as Query DSL" button and enter this:

{
  "query_string": {
    "fields": [
      "host.name"
    ],
    "query": "NDHAHIWEB*"
  }
}

This will do the same thing.

I did change it there.

Before editing the field it returns top values as expected:

Once I Make changes

I'm working on tying to edit that filter as you show. Currently it seems I don't have permissions as the save button is greyed out. Assuming thats the case anyways unless there's another reason it's greyed out.

You are trying to add the filter to the wrong place - in the dimension use "Top values" of host.name as you had it originally, then add the filter in the top bar as you see in my screenshots.

The save button is likely greyed out because there is a syntax error in your json. Make sure to copy it in exactly as in my post above.

If that doesn't work please create a screenshot of what you see to make sure we are talking about the same thing.

1 Like

Thanks I will. We got buried in issues today so didnt get back to it. Appreciate the help.

Thanks once I placed that in the right spot it worked.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.