https://community.splunk.com/t5/Splunk-Search/How-to-get-the-Vcenter-each-VM-since-poweroff-state/m-p/495643#M194590 <P>Can someone help me on this !!!!</P> Sat, 09 May 2020 16:12:43 GMT sivajiy 2020-05-09T16:12:43Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-Vcenter-each-VM-since-poweroff-state/m-p/495642#M194589 <P>Below query i am able to get the snap date. i need to capture correct date and timing.</P> <PRE><CODE>index=vmware-inv sourcetype="vmware:inv:vm" host="*****" | dedup moid sortby time | spath changeSet.summary.runtime.powerState output=powerState | spath changeSet.name output=name | makemv delim=" " time | eval time=mvindex(time,0) | stats latest(powerState) as PowerState by moid,name,time | search PowerState=PoweredOff | sort time </CODE></PRE> Sat, 09 May 2020 16:12:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-Vcenter-each-VM-since-poweroff-state/m-p/495642#M194589 sivajiy 2020-05-09T16:12:03Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-Vcenter-each-VM-since-poweroff-state/m-p/495643#M194590 <P>Can someone help me on this !!!!</P> Sat, 09 May 2020 16:12:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-Vcenter-each-VM-since-poweroff-state/m-p/495643#M194590 sivajiy 2020-05-09T16:12:43Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-Vcenter-each-VM-since-poweroff-state/m-p/495644#M194591 <P>Please share a sample event with private data hidden and identify the field(s) you wish to capture.</P> Sat, 09 May 2020 17:21:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-Vcenter-each-VM-since-poweroff-state/m-p/495644#M194591 richgalloway 2020-05-09T17:21:10Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-Vcenter-each-VM-since-poweroff-state/m-p/495645#M194592 <P>i am getting the out put like below but this is capturing the first snapshot time, but i need out put when it's poweredoff <BR /> vm-***** sevm-KMS-27 2013-04-17 poweredOff<BR /> vm-***** V11-2-L1Con6 2015-03-03 poweredOff</P> Sun, 10 May 2020 14:33:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-Vcenter-each-VM-since-poweroff-state/m-p/495645#M194592 sivajiy 2020-05-10T14:33:45Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-Vcenter-each-VM-since-poweroff-state/m-p/495646#M194593 <P>I see "poweredOff". Isn't that what you want? If not, please share the raw events and what you want from them.</P> Tue, 12 May 2020 12:25:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-Vcenter-each-VM-since-poweroff-state/m-p/495646#M194593 richgalloway 2020-05-12T12:25:23Z