Splunk Search

Help on stats and on regex in a same query

jip31
Motivator

hello I use the code below

index="windows-wmi" (sourcetype="WMI:LastLogon" OR sourcetype="WMI:LastReboot")
| dedup host 

| eval LastLogon = strptime(LastLogon,"%Y%m%d%H%M%S") | rex field=LastLogon mode=sed "s/\..*$$//" | eval LastBootUpTime = strftime(strptime(LastBootUpTime,"%Y%m%d%H%M%S"),"%d/%m/%Y %H:%M") 
| rex field=LastBootUpTime mode=sed "s/\..*$$//" 

| stats latest(LastLogon) as LastLogon, latest(LastBootUpTime) as LastReboot by host

I have results for LastBootUpTime but not for LastLogon
When I just execute the code below I have results for LastLogon

index="windows-wmi" (sourcetype="WMI:LastLogon") 
| dedup host 
| eval LastLogon = strptime(LastLogon,"%Y%m%d%H%M%S") 
| rex field=LastLogon mode=sed "s/\..*$$//" 
| stats latest(LastLogon) as LastLogon by host

What is the problem please
Other issue with rex field=LastLogon
The format of the field is like this : LastLogon=20181128075540.000000+060 but I want to have a date format like this : 28/11/2018 05:55
Could you help me please?

Tags (1)
0 Karma

accsam
New Member

try this

index="windows-wmi" (sourcetype="WMI:LastLogon" OR sourcetype="WMI:LastReboot")
| dedup host,sourcetype
| eval LastLogon = strptime(LastLogon,"%Y%m%d%H%M%S")
| eval LastBootUpTime = strftime(strptime(LastBootUpTime,"%Y%m%d%H%M%S"),"%d/%m/%Y %H:%M")
| rex field=LastLogon mode=sed "s/..*$$//"
| stats latest(LastLogon) as LastLogon, latest(LastBootUpTime) as LastReboot by host

0 Karma

accsam
New Member

Have you tried my answer

0 Karma

jip31
Motivator

yes, when I use you regex | rex field=LastLogon mode=sed "s/..*$$//" have have any results....

0 Karma

jip31
Motivator

I found :
| eval LastLogon = strftime(strptime(LastLogon,"%Y%m%d%H%M%S"),"%d/%m/%Y %H:%M") | rex field=LastLogon mode=sed "s/..*$//" |

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi.. did you try like this(rex sed after finding out the LastBootUpTime):

index="windows-wmi" (sourcetype="WMI:LastLogon") 
 | dedup host 
 | eval LastLogon = strptime(LastLogon,"%Y%m%d%H%M%S") 
 | eval LastBootUpTime = strftime(strptime(LastBootUpTime,"%Y%m%d%H%M%S"),"%d/%m/%Y %H:%M") 
 | rex field=LastLogon mode=sed "s/\..*$$//" 
| stats latest(LastLogon) as LastLogon, latest(LastBootUpTime) as LastReboot by host
thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

jip31
Motivator

HI

With your code I have now results for LastLogon but not for LastBootUpTime...

0 Karma

jip31
Motivator

no sorry I forgot sourcetype="WMI:LastReboot"
so with your code nothing change

0 Karma

jip31
Motivator

I found...
It was due to dedup host....
so it is possible now to help me with the issue with rex field=LastLogon
The format of the field is like this : LastLogon=20181128075540.000000+060 but I want to have a date format like this : 28/11/2018 05:55
thanks

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...