This search checks to make sure a certain process ended on time. I expect to have results for the 6 cases in the where clause below. In the case that a Client's process did not end on time, it would not be returned in this search.
I would like to reverse the logic to return information for when a Client misses an expected end time.
For Example: if client6's process ends after 01:15:00, I would want to see the ClientID and expected time range.
source=*D:\\THY\\helper* source=*IH_Daily\\Debug* End earliest=-30h@h
| eval time=strftime(round(strptime(file_Time, "%I:%M:%S %P")), "%H:%M:%S")
| rex field=source "importhelpers\\\+(?[^\\\]+)"
| where ((like(source,"%"."client1"."%")) AND time>"05:00:00" AND time<"05:15:00")
OR ((like(source,"%"."client2"."%")) AND time>"09:30:00" AND time<"09:45:00")
OR ((like(source,"%"."client3"."%")) AND time>"07:30:00" AND time<"07:42:00")
OR ((like(source,"%"."client4"."%")) AND time>"07:00:00" AND time<"07:25:00")
OR ((like(source,"%"."client5"."%")) AND time>"05:00:00" AND time<"05:30:00")
OR ((like(source,"%"."client6"."%")) AND time>"00:30:00" AND time<"01:15:00")
| table ClientID, timerange, source
Here's how I'd reengineer the tests...
source=*D:\\THY\\helper* source=*IH_Daily\\Debug* End earliest=-30h@h
| eval time=strftime(round(strptime(file_Time, "%I:%M:%S %P")), "%H:%M:%S")
| rex field=source "importhelpers\\\+(?[^\\\]+)"
| eval MyClient=case( like(source,"%"."client1"."%"),"client1",
like(source,"%"."client2"."%"), "client2",
like(source,"%"."client3"."%"), "client3",
like(source,"%"."client4"."%"), "client4",
like(source,"%"."client5"."%"), "client5",
like(source,"%"."client6"."%"), "client6")
| where isnotnull(MyClient)
| eval LowTime=case( MyClient="client1","05:00:00",
MyClient="client2", "09:30:00",
MyClient="client3", "07:30:00",
MyClient="client4", "07:00:00",
MyClient="client5", "05:00:00",
MyClient="client6", "00:30:00")
| eval HighTime=case( MyClient="client1","05:15:00",
MyClient="client2", "09:45:00",
MyClient="client3", "07:42:00",
MyClient="client4", "07:25:00",
MyClient="client5", "05:30:00",
MyClient="client6", "01:15:00")
| eval MyFlag = case(time<LowTime,"Early", time>HighTime,"Late", true(), "On Time")
| table ClientID, source, MyClient, LowTime, HighTime, time, MyFlag
Although actually, I'd put all that client data into a lookup table.
And if you want to have just the ones that are in that time frame, plus mark the missing ones, then add this at the end...
| where MyFlag="On Time"
| append [| makeresults
| eval mydata="client1,05:00:00,05:15:00!!!!client2,09:30:00,09:45:00!!!!client3,07:30:00,07:42:00!!!!client4,07:00:00,07:25:00!!!!client5,05:00:00,05:30:00!!!!client6,00:30:00,01:15:00"
| makemv delim="!!!!" mydata
| mvexpand mydata
| rex field=mydata "(?<MyClient>.+?),(?<LowTime>[^,]+),(?<HighTime>[^,]+)"
| table MyClient LowTime HighTime
]
| stats values(*) as * by MyClient
| eval MyFlag = coalesce(MyFlag, "Missing")
Try this
source=D:\\THY\\helper source=IH_Daily\\Debug End earliest=-30h@h
| eval time=strftime(round(strptime(file_Time, "%I:%M:%S %P")), "%H:%M:%S")
| rex field=source "importhelpers\\+(?[^\\]+)"
| where NOT ((like(source,"%"."client1"."%")) AND time>"05:00:00" AND time<"05:15:00")
OR ((like(source,"%"."client2"."%")) AND time>"09:30:00" AND time<"09:45:00")
OR ((like(source,"%"."client3"."%")) AND time>"07:30:00" AND time<"07:42:00")
OR ((like(source,"%"."client4"."%")) AND time>"07:00:00" AND time<"07:25:00")
OR ((like(source,"%"."client5"."%")) AND time>"05:00:00" AND time<"05:30:00")
OR ((like(source,"%"."client6"."%")) AND time>"00:30:00" AND time<"01:15:00")
| table ClientID, timerange, source
This does not work as there are other end times throughout the log file for each client. This returns the other end times that do not matter. I am seeking to return information if there is no end for a certain client during a specified time. Thanks though!
How about this?
source=D:\\THY\\helper source=IH_Daily\\Debug End earliest=-30h@h
| eval time=strftime(round(strptime(file_Time, "%I:%M:%S %P")), "%H:%M:%S")
| rex field=source "importhelpers\\+(?[^\\]+)"
| where ((like(source,"%"."client1"."%")) AND time>="05:15:00")
OR ((like(source,"%"."client2"."%")) AND time>="09:45:00")
OR ((like(source,"%"."client3"."%")) AND time>="07:42:00")
OR ((like(source,"%"."client4"."%")) AND time>="07:25:00")
OR ((like(source,"%"."client5"."%")) AND time>="05:30:00")
OR ((like(source,"%"."client6"."%")) AND time>="01:15:00")
| table ClientID, timerange, source