Return information when there are no expected results.

[griffinpair]

This search checks to make sure a certain process ended on time. I expect to have results for the 6 cases in the where clause below. In the case that a Client's process did not end on time, it would not be returned in this search.

I would like to reverse the logic to return information for when a Client misses an expected end time.
For Example: if client6's process ends after 01:15:00, I would want to see the ClientID and expected time range.

source=*D:\\THY\\helper* source=*IH_Daily\\Debug* End earliest=-30h@h
| eval time=strftime(round(strptime(file_Time, "%I:%M:%S %P")), "%H:%M:%S")
| rex field=source "importhelpers\\\+(?[^\\\]+)"
| where ((like(source,"%"."client1"."%")) AND time>"05:00:00" AND time<"05:15:00")
OR ((like(source,"%"."client2"."%")) AND time>"09:30:00" AND time<"09:45:00")
OR ((like(source,"%"."client3"."%")) AND time>"07:30:00" AND time<"07:42:00")
OR ((like(source,"%"."client4"."%")) AND time>"07:00:00" AND time<"07:25:00")
OR ((like(source,"%"."client5"."%")) AND time>"05:00:00" AND time<"05:30:00")
OR ((like(source,"%"."client6"."%")) AND time>"00:30:00" AND time<"01:15:00")
| table ClientID, timerange, source

[DalJeanis]

Here's how I'd reengineer the tests...

source=*D:\\THY\\helper* source=*IH_Daily\\Debug* End earliest=-30h@h
| eval time=strftime(round(strptime(file_Time, "%I:%M:%S %P")), "%H:%M:%S")
| rex field=source "importhelpers\\\+(?[^\\\]+)"
| eval MyClient=case( like(source,"%"."client1"."%"),"client1",
   like(source,"%"."client2"."%"), "client2",
   like(source,"%"."client3"."%"), "client3",
   like(source,"%"."client4"."%"), "client4",
   like(source,"%"."client5"."%"), "client5",
   like(source,"%"."client6"."%"), "client6")
| where isnotnull(MyClient)
| eval LowTime=case( MyClient="client1","05:00:00",
   MyClient="client2", "09:30:00",
   MyClient="client3", "07:30:00",
   MyClient="client4", "07:00:00",
   MyClient="client5", "05:00:00",
   MyClient="client6", "00:30:00")
| eval HighTime=case( MyClient="client1","05:15:00",
   MyClient="client2", "09:45:00",
   MyClient="client3", "07:42:00",
   MyClient="client4", "07:25:00",
   MyClient="client5", "05:30:00",
   MyClient="client6", "01:15:00")
| eval MyFlag = case(time<LowTime,"Early", time>HighTime,"Late", true(), "On Time")
| table ClientID, source, MyClient, LowTime, HighTime, time, MyFlag

Although actually, I'd put all that client data into a lookup table.

[DalJeanis]

And if you want to have just the ones that are in that time frame, plus mark the missing ones, then add this at the end...

| where MyFlag="On Time"
| append [| makeresults 
    | eval mydata="client1,05:00:00,05:15:00!!!!client2,09:30:00,09:45:00!!!!client3,07:30:00,07:42:00!!!!client4,07:00:00,07:25:00!!!!client5,05:00:00,05:30:00!!!!client6,00:30:00,01:15:00"  
    | makemv delim="!!!!" mydata 
    | mvexpand mydata 
    | rex field=mydata "(?<MyClient>.+?),(?<LowTime>[^,]+),(?<HighTime>[^,]+)" 
    | table MyClient LowTime HighTime
    ]
| stats values(*) as * by MyClient
| eval MyFlag = coalesce(MyFlag, "Missing") 

[somesoni2]

Try this

source=D:\\THY\\helper source=IH_Daily\\Debug End earliest=-30h@h
| eval time=strftime(round(strptime(file_Time, "%I:%M:%S %P")), "%H:%M:%S")
| rex field=source "importhelpers\\+(?[^\\]+)"
| where NOT ((like(source,"%"."client1"."%")) AND time>"05:00:00" AND time<"05:15:00")
OR ((like(source,"%"."client2"."%")) AND time>"09:30:00" AND time<"09:45:00")
OR ((like(source,"%"."client3"."%")) AND time>"07:30:00" AND time<"07:42:00")
OR ((like(source,"%"."client4"."%")) AND time>"07:00:00" AND time<"07:25:00")
OR ((like(source,"%"."client5"."%")) AND time>"05:00:00" AND time<"05:30:00")
OR ((like(source,"%"."client6"."%")) AND time>"00:30:00" AND time<"01:15:00")
| table ClientID, timerange, source

[griffinpair]

This does not work as there are other end times throughout the log file for each client. This returns the other end times that do not matter. I am seeking to return information if there is no end for a certain client during a specified time. Thanks though!

[somesoni2]

How about this?

source=D:\\THY\\helper source=IH_Daily\\Debug End earliest=-30h@h
 | eval time=strftime(round(strptime(file_Time, "%I:%M:%S %P")), "%H:%M:%S")
 | rex field=source "importhelpers\\+(?[^\\]+)"
 | where ((like(source,"%"."client1"."%")) AND time>="05:15:00")
 OR ((like(source,"%"."client2"."%")) AND time>="09:45:00")
 OR ((like(source,"%"."client3"."%")) AND time>="07:42:00")
 OR ((like(source,"%"."client4"."%")) AND time>="07:25:00")
 OR ((like(source,"%"."client5"."%")) AND time>="05:30:00")
 OR ((like(source,"%"."client6"."%")) AND time>="01:15:00")
 | table ClientID, timerange, source