Screenshots aren't particularly helpful, it is better to paste your search into a code block </>. Also, providing sample (anonymised) events or representative dummy events, again in a code block, al...
See more...
Screenshots aren't particularly helpful, it is better to paste your search into a code block </>. Also, providing sample (anonymised) events or representative dummy events, again in a code block, also helps. Having said that, does something like this help: | bin span=7d _time aligntime=earliest
| stats max(version) as latestversion by ComputerName, _time
| rex field=latestversion "(?<latestversionT>\d{6})"
| eval today_date=strftime(now(),"%d-%m-%y") ``` No longer required? ```
| eval today_DAT=strftime(now(),"%y%m%d") ``` No longer required? ```
| eval diff = floor((relative_time(now(),"@d") - strptime(latestversionT, "%y%m%d"))/86400)
| eval status = if(diff<=7,"Compliant","Non-Compliant") I generated some dummy sample data like this: | gentimes start=-30 increment=1h
| rename starttime as _time
| fields _time
| eval ComputerName=mvindex(split("ABCDEFGHIJ",""),random()%10)
| eval version=strftime(relative_time(_time,"-".(random()%5+1)."d"),"%y%m%d").printf("%03d",(random()%100))