Splunk Search

Help on stats and on regex in a same query

jip31
Motivator

hello I use the code below

index="windows-wmi" (sourcetype="WMI:LastLogon" OR sourcetype="WMI:LastReboot")
| dedup host 

| eval LastLogon = strptime(LastLogon,"%Y%m%d%H%M%S") | rex field=LastLogon mode=sed "s/\..*$$//" | eval LastBootUpTime = strftime(strptime(LastBootUpTime,"%Y%m%d%H%M%S"),"%d/%m/%Y %H:%M") 
| rex field=LastBootUpTime mode=sed "s/\..*$$//" 

| stats latest(LastLogon) as LastLogon, latest(LastBootUpTime) as LastReboot by host

I have results for LastBootUpTime but not for LastLogon
When I just execute the code below I have results for LastLogon

index="windows-wmi" (sourcetype="WMI:LastLogon") 
| dedup host 
| eval LastLogon = strptime(LastLogon,"%Y%m%d%H%M%S") 
| rex field=LastLogon mode=sed "s/\..*$$//" 
| stats latest(LastLogon) as LastLogon by host

What is the problem please
Other issue with rex field=LastLogon
The format of the field is like this : LastLogon=20181128075540.000000+060 but I want to have a date format like this : 28/11/2018 05:55
Could you help me please?

Tags (1)
0 Karma

accsam
New Member

try this

index="windows-wmi" (sourcetype="WMI:LastLogon" OR sourcetype="WMI:LastReboot")
| dedup host,sourcetype
| eval LastLogon = strptime(LastLogon,"%Y%m%d%H%M%S")
| eval LastBootUpTime = strftime(strptime(LastBootUpTime,"%Y%m%d%H%M%S"),"%d/%m/%Y %H:%M")
| rex field=LastLogon mode=sed "s/..*$$//"
| stats latest(LastLogon) as LastLogon, latest(LastBootUpTime) as LastReboot by host

0 Karma

accsam
New Member

Have you tried my answer

0 Karma

jip31
Motivator

yes, when I use you regex | rex field=LastLogon mode=sed "s/..*$$//" have have any results....

0 Karma

jip31
Motivator

I found :
| eval LastLogon = strftime(strptime(LastLogon,"%Y%m%d%H%M%S"),"%d/%m/%Y %H:%M") | rex field=LastLogon mode=sed "s/..*$//" |

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi.. did you try like this(rex sed after finding out the LastBootUpTime):

index="windows-wmi" (sourcetype="WMI:LastLogon") 
 | dedup host 
 | eval LastLogon = strptime(LastLogon,"%Y%m%d%H%M%S") 
 | eval LastBootUpTime = strftime(strptime(LastBootUpTime,"%Y%m%d%H%M%S"),"%d/%m/%Y %H:%M") 
 | rex field=LastLogon mode=sed "s/\..*$$//" 
| stats latest(LastLogon) as LastLogon, latest(LastBootUpTime) as LastReboot by host
thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

jip31
Motivator

HI

With your code I have now results for LastLogon but not for LastBootUpTime...

0 Karma

jip31
Motivator

no sorry I forgot sourcetype="WMI:LastReboot"
so with your code nothing change

0 Karma

jip31
Motivator

I found...
It was due to dedup host....
so it is possible now to help me with the issue with rex field=LastLogon
The format of the field is like this : LastLogon=20181128075540.000000+060 but I want to have a date format like this : 28/11/2018 05:55
thanks

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...