Help on stats and on regex in a same query

[jip31]

hello I use the code below

index="windows-wmi" (sourcetype="WMI:LastLogon" OR sourcetype="WMI:LastReboot")
| dedup host 

| eval LastLogon = strptime(LastLogon,"%Y%m%d%H%M%S") | rex field=LastLogon mode=sed "s/\..*$$//" | eval LastBootUpTime = strftime(strptime(LastBootUpTime,"%Y%m%d%H%M%S"),"%d/%m/%Y %H:%M") 
| rex field=LastBootUpTime mode=sed "s/\..*$$//" 

| stats latest(LastLogon) as LastLogon, latest(LastBootUpTime) as LastReboot by host

I have results for LastBootUpTime but not for LastLogon
When I just execute the code below I have results for LastLogon

index="windows-wmi" (sourcetype="WMI:LastLogon") 
| dedup host 
| eval LastLogon = strptime(LastLogon,"%Y%m%d%H%M%S") 
| rex field=LastLogon mode=sed "s/\..*$$//" 
| stats latest(LastLogon) as LastLogon by host

What is the problem please
Other issue with rex field=LastLogon
The format of the field is like this : LastLogon=20181128075540.000000+060 but I want to have a date format like this : 28/11/2018 05:55
Could you help me please?

[accsam]

try this

index="windows-wmi" (sourcetype="WMI:LastLogon" OR sourcetype="WMI:LastReboot")
| dedup host,sourcetype
| eval LastLogon = strptime(LastLogon,"%Y%m%d%H%M%S")
| eval LastBootUpTime = strftime(strptime(LastBootUpTime,"%Y%m%d%H%M%S"),"%d/%m/%Y %H:%M")
| rex field=LastLogon mode=sed "s/..*$$//"
| stats latest(LastLogon) as LastLogon, latest(LastBootUpTime) as LastReboot by host

[accsam]

Have you tried my answer

[jip31]

yes, when I use you regex | rex field=LastLogon mode=sed "s/..*$$//" have have any results....

[jip31]

I found :
| eval LastLogon = strftime(strptime(LastLogon,"%Y%m%d%H%M%S"),"%d/%m/%Y %H:%M") | rex field=LastLogon mode=sed "s/..*$//" |

[inventsekar]

Hi.. did you try like this(rex sed after finding out the LastBootUpTime):

index="windows-wmi" (sourcetype="WMI:LastLogon") 
 | dedup host 
 | eval LastLogon = strptime(LastLogon,"%Y%m%d%H%M%S") 
 | eval LastBootUpTime = strftime(strptime(LastBootUpTime,"%Y%m%d%H%M%S"),"%d/%m/%Y %H:%M") 
 | rex field=LastLogon mode=sed "s/\..*$$//" 
| stats latest(LastLogon) as LastLogon, latest(LastBootUpTime) as LastReboot by host

[jip31]

HI

With your code I have now results for LastLogon but not for LastBootUpTime...

[jip31]

no sorry I forgot sourcetype="WMI:LastReboot"
so with your code nothing change

[jip31]

I found...
It was due to dedup host....
so it is possible now to help me with the issue with rex field=LastLogon
The format of the field is like this : LastLogon=20181128075540.000000+060 but I want to have a date format like this : 28/11/2018 05:55
thanks