Splunk Search

Help on stats and on regex in a same query

jip31
Motivator

hello I use the code below

index="windows-wmi" (sourcetype="WMI:LastLogon" OR sourcetype="WMI:LastReboot")
| dedup host 

| eval LastLogon = strptime(LastLogon,"%Y%m%d%H%M%S") | rex field=LastLogon mode=sed "s/\..*$$//" | eval LastBootUpTime = strftime(strptime(LastBootUpTime,"%Y%m%d%H%M%S"),"%d/%m/%Y %H:%M") 
| rex field=LastBootUpTime mode=sed "s/\..*$$//" 

| stats latest(LastLogon) as LastLogon, latest(LastBootUpTime) as LastReboot by host

I have results for LastBootUpTime but not for LastLogon
When I just execute the code below I have results for LastLogon

index="windows-wmi" (sourcetype="WMI:LastLogon") 
| dedup host 
| eval LastLogon = strptime(LastLogon,"%Y%m%d%H%M%S") 
| rex field=LastLogon mode=sed "s/\..*$$//" 
| stats latest(LastLogon) as LastLogon by host

What is the problem please
Other issue with rex field=LastLogon
The format of the field is like this : LastLogon=20181128075540.000000+060 but I want to have a date format like this : 28/11/2018 05:55
Could you help me please?

Tags (1)
0 Karma

accsam
New Member

try this

index="windows-wmi" (sourcetype="WMI:LastLogon" OR sourcetype="WMI:LastReboot")
| dedup host,sourcetype
| eval LastLogon = strptime(LastLogon,"%Y%m%d%H%M%S")
| eval LastBootUpTime = strftime(strptime(LastBootUpTime,"%Y%m%d%H%M%S"),"%d/%m/%Y %H:%M")
| rex field=LastLogon mode=sed "s/..*$$//"
| stats latest(LastLogon) as LastLogon, latest(LastBootUpTime) as LastReboot by host

0 Karma

accsam
New Member

Have you tried my answer

0 Karma

jip31
Motivator

yes, when I use you regex | rex field=LastLogon mode=sed "s/..*$$//" have have any results....

0 Karma

jip31
Motivator

I found :
| eval LastLogon = strftime(strptime(LastLogon,"%Y%m%d%H%M%S"),"%d/%m/%Y %H:%M") | rex field=LastLogon mode=sed "s/..*$//" |

0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi.. did you try like this(rex sed after finding out the LastBootUpTime):

index="windows-wmi" (sourcetype="WMI:LastLogon") 
 | dedup host 
 | eval LastLogon = strptime(LastLogon,"%Y%m%d%H%M%S") 
 | eval LastBootUpTime = strftime(strptime(LastBootUpTime,"%Y%m%d%H%M%S"),"%d/%m/%Y %H:%M") 
 | rex field=LastLogon mode=sed "s/\..*$$//" 
| stats latest(LastLogon) as LastLogon, latest(LastBootUpTime) as LastReboot by host
0 Karma

jip31
Motivator

HI

With your code I have now results for LastLogon but not for LastBootUpTime...

0 Karma

jip31
Motivator

no sorry I forgot sourcetype="WMI:LastReboot"
so with your code nothing change

0 Karma

jip31
Motivator

I found...
It was due to dedup host....
so it is possible now to help me with the issue with rex field=LastLogon
The format of the field is like this : LastLogon=20181128075540.000000+060 but I want to have a date format like this : 28/11/2018 05:55
thanks

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...