Splunk Search

Return information when there are no expected results.

Explorer

This search checks to make sure a certain process ended on time. I expect to have results for the 6 cases in the where clause below. In the case that a Client's process did not end on time, it would not be returned in this search.

I would like to reverse the logic to return information for when a Client misses an expected end time.
For Example: if client6's process ends after 01:15:00, I would want to see the ClientID and expected time range.

source=*D:\\THY\\helper* source=*IH_Daily\\Debug* End earliest=-30h@h
| eval time=strftime(round(strptime(file_Time, "%I:%M:%S %P")), "%H:%M:%S")
| rex field=source "importhelpers\\\+(?[^\\\]+)"
| where ((like(source,"%"."client1"."%")) AND time>"05:00:00" AND time<"05:15:00")
OR ((like(source,"%"."client2"."%")) AND time>"09:30:00" AND time<"09:45:00")
OR ((like(source,"%"."client3"."%")) AND time>"07:30:00" AND time<"07:42:00")
OR ((like(source,"%"."client4"."%")) AND time>"07:00:00" AND time<"07:25:00")
OR ((like(source,"%"."client5"."%")) AND time>"05:00:00" AND time<"05:30:00")
OR ((like(source,"%"."client6"."%")) AND time>"00:30:00" AND time<"01:15:00")
| table ClientID, timerange, source
0 Karma

SplunkTrust
SplunkTrust

Here's how I'd reengineer the tests...

source=*D:\\THY\\helper* source=*IH_Daily\\Debug* End earliest=-30h@h
| eval time=strftime(round(strptime(file_Time, "%I:%M:%S %P")), "%H:%M:%S")
| rex field=source "importhelpers\\\+(?[^\\\]+)"
| eval MyClient=case( like(source,"%"."client1"."%"),"client1",
   like(source,"%"."client2"."%"), "client2",
   like(source,"%"."client3"."%"), "client3",
   like(source,"%"."client4"."%"), "client4",
   like(source,"%"."client5"."%"), "client5",
   like(source,"%"."client6"."%"), "client6")
| where isnotnull(MyClient)
| eval LowTime=case( MyClient="client1","05:00:00",
   MyClient="client2", "09:30:00",
   MyClient="client3", "07:30:00",
   MyClient="client4", "07:00:00",
   MyClient="client5", "05:00:00",
   MyClient="client6", "00:30:00")
| eval HighTime=case( MyClient="client1","05:15:00",
   MyClient="client2", "09:45:00",
   MyClient="client3", "07:42:00",
   MyClient="client4", "07:25:00",
   MyClient="client5", "05:30:00",
   MyClient="client6", "01:15:00")
| eval MyFlag = case(time<LowTime,"Early", time>HighTime,"Late", true(), "On Time")
| table ClientID, source, MyClient, LowTime, HighTime, time, MyFlag

Although actually, I'd put all that client data into a lookup table.

0 Karma

SplunkTrust
SplunkTrust

And if you want to have just the ones that are in that time frame, plus mark the missing ones, then add this at the end...

| where MyFlag="On Time"
| append [| makeresults 
    | eval mydata="client1,05:00:00,05:15:00!!!!client2,09:30:00,09:45:00!!!!client3,07:30:00,07:42:00!!!!client4,07:00:00,07:25:00!!!!client5,05:00:00,05:30:00!!!!client6,00:30:00,01:15:00"  
    | makemv delim="!!!!" mydata 
    | mvexpand mydata 
    | rex field=mydata "(?<MyClient>.+?),(?<LowTime>[^,]+),(?<HighTime>[^,]+)" 
    | table MyClient LowTime HighTime
    ]
| stats values(*) as * by MyClient
| eval MyFlag = coalesce(MyFlag, "Missing") 
0 Karma

Revered Legend

Try this

source=D:\\THY\\helper source=IH_Daily\\Debug End earliest=-30h@h
| eval time=strftime(round(strptime(file_Time, "%I:%M:%S %P")), "%H:%M:%S")
| rex field=source "importhelpers\\+(?[^\\]+)"
| where NOT ((like(source,"%"."client1"."%")) AND time>"05:00:00" AND time<"05:15:00")
OR ((like(source,"%"."client2"."%")) AND time>"09:30:00" AND time<"09:45:00")
OR ((like(source,"%"."client3"."%")) AND time>"07:30:00" AND time<"07:42:00")
OR ((like(source,"%"."client4"."%")) AND time>"07:00:00" AND time<"07:25:00")
OR ((like(source,"%"."client5"."%")) AND time>"05:00:00" AND time<"05:30:00")
OR ((like(source,"%"."client6"."%")) AND time>"00:30:00" AND time<"01:15:00")
| table ClientID, timerange, source
0 Karma

Explorer

This does not work as there are other end times throughout the log file for each client. This returns the other end times that do not matter. I am seeking to return information if there is no end for a certain client during a specified time. Thanks though!

0 Karma

Revered Legend

How about this?

source=D:\\THY\\helper source=IH_Daily\\Debug End earliest=-30h@h
 | eval time=strftime(round(strptime(file_Time, "%I:%M:%S %P")), "%H:%M:%S")
 | rex field=source "importhelpers\\+(?[^\\]+)"
 | where ((like(source,"%"."client1"."%")) AND time>="05:15:00")
 OR ((like(source,"%"."client2"."%")) AND time>="09:45:00")
 OR ((like(source,"%"."client3"."%")) AND time>="07:42:00")
 OR ((like(source,"%"."client4"."%")) AND time>="07:25:00")
 OR ((like(source,"%"."client5"."%")) AND time>="05:30:00")
 OR ((like(source,"%"."client6"."%")) AND time>="01:15:00")
 | table ClientID, timerange, source
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!