Hi, please consider this example.csv: device result _time apollo1 passed 2019-06-28 apollo1 failed 2019-06-28 zeus8 passed 2019-06-23 zeus8 failed 2019-06-23 zeus8 error 2019-06-23 hermes3 failed 2019-06-23 //Edit #1 hermes3 failed 2019-06-23 //Edit #1 apollo1 passed 2019-06-20 //Edit #1 Note: This is just an example. My real CSV has thousands of devices. I want to return the latest entry based on the device value. When a device appears more than once with a duplicated timestamp and different result value, the event where result = passed should appear. Else, show the event where result is failed or error. What query do I need to do that? My current query ( |inputlookup example.csv |stats latest by device ) does not guarantee the event where result = passed will appear when a device shows up multiple times with with the same latest timestamp and different result values. //Edit #1 below The query I need would produce the table below: device result _time apollo1 passed 2019-06-28 zeus8 passed 2019-06-23 hermes3 failed 2019-06-23 The query would 1) show only the latest device with the latest _time , 2) if a device is listed twice with the same _time and a different result , show just the device where result = passed. Else display the event with either failed or error, and 3) since conditions 1 and 2 are followed, each device should only appear once. ... View more

Hi, please consider this example panel within my dashboard: ticketID due_date days_remaining ticket1 07/20/2019 19 ticket2 08/20/2019 49 ticket3 09/20/2019 79 I know I can color the days_remaining field using the UI, but my quesition is: how do I color cells under due_date based on the range the corresponding days_remaining field values are within? The range conditions are 0-30 is red, 31-60 is yellow, and 61-90 is green. With the example panel above, 07/20/2019 should be red, 08/20/2019 should be yellow, and 09/20/2019 should be green. Note: I'm a Power User at work so I don't have access to .conf files. Can I achieve my solution using xml? Or maybe JavaScript (if I even have access). ... View more

Hello, I have a scheduled search that populates a CSV with data each day, including the current date. Here is an example: device battery date desktop 100 05/04/19 laptop 100 05/04/19 printer 100 05/04/19 desktop 100 05/05/19 laptop 100 05/05/19 printer 100 05/05/19 desktop 100 05/06/19 laptop 90 05/06/19 printer 90 05/06/19 What query would I need to put into an alert that would notify me when a device that had 100 in its battery field the previous day is below 100 on the current day? The result should return just the device names, which here would be laptop and printer . Note: I do know this could be helpful in the query where it shows data for the current day and the previous day. Feel free to use it if you'd like: | where (date == strftime(relative_time(now(), "-1d@d"), "%m/%d/%y")) OR (date == strftime(now(), "%m/%d/%y") ) ... View more

Hi, I've gotten User, Power User, and Enterprise Admin with the new post-August 2018 exam setup. When I need to renew my certs in two years (probably just Ent Admin if I don't get another one), will I need to take the exam again? Or are there CPEs and a fee to pay to renew the certs? If we're all required to take the exam(s) again, now I understand why the exams are so cheap relative to other certifications. ... View more

Hi, When I run index=wineventlog earliest=-5s@s latest=now the results are 35k events. When I run sourcetype=mySourceType earliest=-15m@m latest=now the results are 2k events. Both searches take only 10 or so seconds. But when I run (index="wineventlog" earliest=-5s@s latest=now) OR (sourcetype="mySourceType earliest=-15m@m latest=now) the search will run for 60seconds, search through 1.5million events and will only be 0.29% complete at the 60 second mark (according to the job inspector). The time picker is set to All Time (I'm assuming having time modifiers in the query will have the time picker be ignored). Why is that? My ultimate goal is to search 3 indexes together overnight with OR , and without using a subsearch (due to subsearch time limitations set by admins). ... View more

Hi, I have 2 scheduled searches that run each morning. When I run them manually, 60k results are returned and output to their own CSV. When they run on their own each morning (according to the specifed time), exactly 50,000 results are returned and output to their CSVs. Where should I look to investigate and find the source of this issue? ... View more

With my situation, all events have double the values in each field for some reason. I'm not an admin so I just have to work with it until they fix it. Data might look like this: color name blue bill blue bill green gus green gus The above are pretty much 4 multivalue cells. So I run the below to return just the first string before the line break for each cell: | eval severity=mvindex(name,0) | stats count(eval(name="bill")) as badGuy And the count result will still be 2 instead of one. Same with "gus". Why is that? note: mvexpand + dedup is not an option for this situation. ... View more