Splunk Search

How to extract the below mentioned fields from the raw date to interesting fields to apt the efficient query

Muni9066
New Member

Hi Team,

I was trying to find out the workstations clock out of sync logs in splunk by using the below query. but I can not getting the expected logs.  Also, could not able to see the previous time field in interesting fields but it was existing in raw message field. can someone help me out how to make this query efficient...? 

index=*_win sourcetype=wineventlog EventCode=4616 category="Security State Change"
| stats max(Previous Time) by asset_id
| where isnull(lastTime)
| addinfo
| eval hourDiff=floor((info_max_time-info_min_time)/3600)
| fields dest,should_timesync,hourDiff

Thanks in advance

Previous Time: ‎2023‎-‎08‎-‎09T09:18:00.490316500Z 

Labels (5)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Muni9066 ,

after a stats command you have only the fields listed in the command itself, in your case you have only max(Previous Time) (it's always better to use the AS after a function in stats) and asset_id.

So the other used fields (lastTime, dest, should_timesync) aren't available.

Ciao.

Giuseppe

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

From what I understand, the "Previous Time" field has not been extracted from the raw logs?

If so, and you need help extracting the field, please share examples of the raw log event in a code block </> so we can assist you in extracting the field.

By the way, in order to do mathematical operations on fields, such as max(), the values should be numeric not strings, so you may need to also consider parsing the string to convert it to a numeric (strptime() function)

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...