https://community.splunk.com/t5/Splunk-Search/Search-to-find-the-timestamp-of-each-Login-Logout-Expire-keyword/m-p/490940#M137077 <P>Try this:</P> <PRE><CODE>index=serverlogs source=server*.log | eval status=case( match(_raw, "Login", "Login", match(_raw, "LogOut", "Logout", match(_raw, "Expire", "Expire", true(), "Other") </CODE></PRE> Fri, 04 Oct 2019 02:09:56 GMT woodcock 2019-10-04T02:09:56Z https://community.splunk.com/t5/Splunk-Search/Search-to-find-the-timestamp-of-each-Login-Logout-Expire-keyword/m-p/490938#M137075 <P>Hi Guys,</P> <P>Can anyone please help me in the below search.<BR /> I want the name of all logfiles with details of keywords from each sourcetype.<BR /> If there is a keyword present in the specific log file then the last time when that keyword was there in the log file.</P> <P><STRONG>Log_Name | Updatedago | Login | Logout | Expire<BR /> Server.log | Last Login event at "TimeFrame"| Last LogOut event at "TimeFrame"| Last Expire event at "TimeFrame"<BR /> Server1.log | Last Login event at "TimeFrame"| Last LogOut event at "TimeFrame"| Last Expire event at "TimeFrame"</STRONG></P> <P>The Login , Logout, Expire are the keywords available in _raw field.<BR /> The timestamp field specifies the logs are updated how many minutes/hours ago(last updated time of log file)</P> <P>I am using below search but no results and not sure how to get last updated thing:</P> <PRE><CODE>index=serverlogs source=server*.log | eval status=if(_raw LIKE "*Login*" ,Login, _raw LIKE "*LogOut*","Logout", _raw LIKE "*Expire*","Expire",0 ) </CODE></PRE> Fri, 27 Sep 2019 22:13:34 GMT https://community.splunk.com/t5/Splunk-Search/Search-to-find-the-timestamp-of-each-Login-Logout-Expire-keyword/m-p/490938#M137075 sahil237888 2019-09-27T22:13:34Z https://community.splunk.com/t5/Splunk-Search/Search-to-find-the-timestamp-of-each-Login-Logout-Expire-keyword/m-p/490939#M137076 <P>Hi sahil237888,<BR /> whay don't you tried to use tags?<BR /> you should create three different eventypes and associate to each of them a tag:</P> <UL> <LI><CODE>index=serverlogs source=server*.log login</CODE> for tag=login</LI> <LI><CODE>index=serverlogs source=server*.log logout</CODE> for tag=logout</LI> <LI><CODE>index=serverlogs source=server*.log logfail</CODE> for tag=logfail</LI> </UL> <P>In this way, yoy have the keywords to display:</P> <PRE><CODE>index=serverlogs source=server*.log | table _time source tag </CODE></PRE> <P>Using this method I created an entire apps to display login, logout and logfail of many different systems, creating many eventyper (three for each kind of system) associating the related tag.</P> <P>Bye.<BR /> Giuseppe</P> Sat, 28 Sep 2019 08:20:59 GMT https://community.splunk.com/t5/Splunk-Search/Search-to-find-the-timestamp-of-each-Login-Logout-Expire-keyword/m-p/490939#M137076 gcusello 2019-09-28T08:20:59Z https://community.splunk.com/t5/Splunk-Search/Search-to-find-the-timestamp-of-each-Login-Logout-Expire-keyword/m-p/490940#M137077 <P>Try this:</P> <PRE><CODE>index=serverlogs source=server*.log | eval status=case( match(_raw, "Login", "Login", match(_raw, "LogOut", "Logout", match(_raw, "Expire", "Expire", true(), "Other") </CODE></PRE> Fri, 04 Oct 2019 02:09:56 GMT https://community.splunk.com/t5/Splunk-Search/Search-to-find-the-timestamp-of-each-Login-Logout-Expire-keyword/m-p/490940#M137077 woodcock 2019-10-04T02:09:56Z