Splunk Search

Return information when there are no expected results.

griffinpair
Path Finder

This search checks to make sure a certain process ended on time. I expect to have results for the 6 cases in the where clause below. In the case that a Client's process did not end on time, it would not be returned in this search.

I would like to reverse the logic to return information for when a Client misses an expected end time.
For Example: if client6's process ends after 01:15:00, I would want to see the ClientID and expected time range.

source=*D:\\THY\\helper* source=*IH_Daily\\Debug* End earliest=-30h@h
| eval time=strftime(round(strptime(file_Time, "%I:%M:%S %P")), "%H:%M:%S")
| rex field=source "importhelpers\\\+(?[^\\\]+)"
| where ((like(source,"%"."client1"."%")) AND time>"05:00:00" AND time<"05:15:00")
OR ((like(source,"%"."client2"."%")) AND time>"09:30:00" AND time<"09:45:00")
OR ((like(source,"%"."client3"."%")) AND time>"07:30:00" AND time<"07:42:00")
OR ((like(source,"%"."client4"."%")) AND time>"07:00:00" AND time<"07:25:00")
OR ((like(source,"%"."client5"."%")) AND time>"05:00:00" AND time<"05:30:00")
OR ((like(source,"%"."client6"."%")) AND time>"00:30:00" AND time<"01:15:00")
| table ClientID, timerange, source
0 Karma

DalJeanis
Legend

Here's how I'd reengineer the tests...

source=*D:\\THY\\helper* source=*IH_Daily\\Debug* End earliest=-30h@h
| eval time=strftime(round(strptime(file_Time, "%I:%M:%S %P")), "%H:%M:%S")
| rex field=source "importhelpers\\\+(?[^\\\]+)"
| eval MyClient=case( like(source,"%"."client1"."%"),"client1",
   like(source,"%"."client2"."%"), "client2",
   like(source,"%"."client3"."%"), "client3",
   like(source,"%"."client4"."%"), "client4",
   like(source,"%"."client5"."%"), "client5",
   like(source,"%"."client6"."%"), "client6")
| where isnotnull(MyClient)
| eval LowTime=case( MyClient="client1","05:00:00",
   MyClient="client2", "09:30:00",
   MyClient="client3", "07:30:00",
   MyClient="client4", "07:00:00",
   MyClient="client5", "05:00:00",
   MyClient="client6", "00:30:00")
| eval HighTime=case( MyClient="client1","05:15:00",
   MyClient="client2", "09:45:00",
   MyClient="client3", "07:42:00",
   MyClient="client4", "07:25:00",
   MyClient="client5", "05:30:00",
   MyClient="client6", "01:15:00")
| eval MyFlag = case(time<LowTime,"Early", time>HighTime,"Late", true(), "On Time")
| table ClientID, source, MyClient, LowTime, HighTime, time, MyFlag

Although actually, I'd put all that client data into a lookup table.

0 Karma

DalJeanis
Legend

And if you want to have just the ones that are in that time frame, plus mark the missing ones, then add this at the end...

| where MyFlag="On Time"
| append [| makeresults 
    | eval mydata="client1,05:00:00,05:15:00!!!!client2,09:30:00,09:45:00!!!!client3,07:30:00,07:42:00!!!!client4,07:00:00,07:25:00!!!!client5,05:00:00,05:30:00!!!!client6,00:30:00,01:15:00"  
    | makemv delim="!!!!" mydata 
    | mvexpand mydata 
    | rex field=mydata "(?<MyClient>.+?),(?<LowTime>[^,]+),(?<HighTime>[^,]+)" 
    | table MyClient LowTime HighTime
    ]
| stats values(*) as * by MyClient
| eval MyFlag = coalesce(MyFlag, "Missing") 
0 Karma

somesoni2
Revered Legend

Try this

source=D:\\THY\\helper source=IH_Daily\\Debug End earliest=-30h@h
| eval time=strftime(round(strptime(file_Time, "%I:%M:%S %P")), "%H:%M:%S")
| rex field=source "importhelpers\\+(?[^\\]+)"
| where NOT ((like(source,"%"."client1"."%")) AND time>"05:00:00" AND time<"05:15:00")
OR ((like(source,"%"."client2"."%")) AND time>"09:30:00" AND time<"09:45:00")
OR ((like(source,"%"."client3"."%")) AND time>"07:30:00" AND time<"07:42:00")
OR ((like(source,"%"."client4"."%")) AND time>"07:00:00" AND time<"07:25:00")
OR ((like(source,"%"."client5"."%")) AND time>"05:00:00" AND time<"05:30:00")
OR ((like(source,"%"."client6"."%")) AND time>"00:30:00" AND time<"01:15:00")
| table ClientID, timerange, source
0 Karma

griffinpair
Path Finder

This does not work as there are other end times throughout the log file for each client. This returns the other end times that do not matter. I am seeking to return information if there is no end for a certain client during a specified time. Thanks though!

0 Karma

somesoni2
Revered Legend

How about this?

source=D:\\THY\\helper source=IH_Daily\\Debug End earliest=-30h@h
 | eval time=strftime(round(strptime(file_Time, "%I:%M:%S %P")), "%H:%M:%S")
 | rex field=source "importhelpers\\+(?[^\\]+)"
 | where ((like(source,"%"."client1"."%")) AND time>="05:15:00")
 OR ((like(source,"%"."client2"."%")) AND time>="09:45:00")
 OR ((like(source,"%"."client3"."%")) AND time>="07:42:00")
 OR ((like(source,"%"."client4"."%")) AND time>="07:25:00")
 OR ((like(source,"%"."client5"."%")) AND time>="05:30:00")
 OR ((like(source,"%"."client6"."%")) AND time>="01:15:00")
 | table ClientID, timerange, source
0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...