topic Re: Help on stats and on regex in a same query in Splunk Search

Help on stats and on regex in a same query

jip31 — Wed, 28 Nov 2018 07:14:33 GMT

hello I use the code below

index="windows-wmi" (sourcetype="WMI:LastLogon" OR sourcetype="WMI:LastReboot")
| dedup host 

| eval LastLogon = strptime(LastLogon,"%Y%m%d%H%M%S") | rex field=LastLogon mode=sed "s/\..*$$//" | eval LastBootUpTime = strftime(strptime(LastBootUpTime,"%Y%m%d%H%M%S"),"%d/%m/%Y %H:%M") 
| rex field=LastBootUpTime mode=sed "s/\..*$$//" 

| stats latest(LastLogon) as LastLogon, latest(LastBootUpTime) as LastReboot by host

I have results for LastBootUpTime but not for LastLogon
When I just execute the code below I have results for LastLogon

index="windows-wmi" (sourcetype="WMI:LastLogon") 
| dedup host 
| eval LastLogon = strptime(LastLogon,"%Y%m%d%H%M%S") 
| rex field=LastLogon mode=sed "s/\..*$$//" 
| stats latest(LastLogon) as LastLogon by host

What is the problem please
Other issue with rex field=LastLogon
The format of the field is like this : LastLogon=20181128075540.000000+060 but I want to have a date format like this : 28/11/2018 05:55
Could you help me please?

Re: Help on stats and on regex in a same query

inventsekar — Wed, 28 Nov 2018 08:28:14 GMT

Hi.. did you try like this(rex sed after finding out the LastBootUpTime):

index="windows-wmi" (sourcetype="WMI:LastLogon") 
 | dedup host 
 | eval LastLogon = strptime(LastLogon,"%Y%m%d%H%M%S") 
 | eval LastBootUpTime = strftime(strptime(LastBootUpTime,"%Y%m%d%H%M%S"),"%d/%m/%Y %H:%M") 
 | rex field=LastLogon mode=sed "s/\..*$$//" 
| stats latest(LastLogon) as LastLogon, latest(LastBootUpTime) as LastReboot by host

Re: Help on stats and on regex in a same query

accsam — Wed, 28 Nov 2018 08:38:33 GMT

try this

index="windows-wmi" (sourcetype="WMI:LastLogon" OR sourcetype="WMI:LastReboot")
| dedup host,sourcetype
| eval LastLogon = strptime(LastLogon,"%Y%m%d%H%M%S")
| eval LastBootUpTime = strftime(strptime(LastBootUpTime,"%Y%m%d%H%M%S"),"%d/%m/%Y %H:%M")
| rex field=LastLogon mode=sed "s/..*$$//"
| stats latest(LastLogon) as LastLogon, latest(LastBootUpTime) as LastReboot by host

Re: Help on stats and on regex in a same query

jip31 — Wed, 28 Nov 2018 14:58:23 GMT

With your code I have now results for LastLogon but not for LastBootUpTime...

Re: Help on stats and on regex in a same query

jip31 — Wed, 28 Nov 2018 15:04:24 GMT

no sorry I forgot sourcetype="WMI:LastReboot"
so with your code nothing change

Re: Help on stats and on regex in a same query

jip31 — Wed, 28 Nov 2018 15:10:27 GMT

I found...
It was due to dedup host....
so it is possible now to help me with the issue with rex field=LastLogon
The format of the field is like this : LastLogon=20181128075540.000000+060 but I want to have a date format like this : 28/11/2018 05:55
thanks

Re: Help on stats and on regex in a same query

accsam — Thu, 29 Nov 2018 04:19:35 GMT

Have you tried my answer

Re: Help on stats and on regex in a same query

jip31 — Thu, 29 Nov 2018 06:52:22 GMT

yes, when I use you regex | rex field=LastLogon mode=sed "s/..*$$//" have have any results....

Re: Help on stats and on regex in a same query

jip31 — Thu, 29 Nov 2018 06:56:16 GMT

I found :
| eval LastLogon = strftime(strptime(LastLogon,"%Y%m%d%H%M%S"),"%d/%m/%Y %H:%M") | rex field=LastLogon mode=sed "s/..*$//" |