i believe you missanderstood, it´s right if an event does not contain the Audit Id field rex will fail to find it, this is a normal behavior. But if i have 100 Events in summary and 10 of them contains the Audit ID i would like to have the new field auditID with 80 NULL values and 10 correct matches. ... View more

Thank you, this is exactly what i had, but now i realized the real problem: I forgot to mention that there are a lot of Events without the Audit ID and then it doesnt work. In approx. 200 Events the Audit ID is present just a few times. If i pre-filter the Events then the rex works !! i do not understand this behaivor... ... View more

...and i have to search for "Audit ID" because the ID is not always on the same place! i tried a lot but nothing works ... View more

maybe this works also, but in my case the concurrency command is the easier way... thanks anyway ... View more

thanks thats it! 🙂 🙂 🙂 ... View more

Thank you, now you brought me to this final and great result: my base search | stats count by computerName name,atage | eval Servicetime=round(count*100/(Days*11),4) | eval Servicetime=if(Servicetime>100,100.0000,Servicetime) | fields - Days,count | chart sum(Servicetime) over computerName by name ... View more

ok thanks, but i cant use the top command because splunk can not know my definition for 100 percent. it depends on the lookup result. is there no way to do this? ... View more

mmmhhh, i got a list with a lot of records from my search query and i want to know if something is truncated for a value in every record separately! ... View more

hi, this is what job inspector says: (first reaching is with mvexpand or is it just by happenstance?, then presort and so on...) Execution costs Duration (seconds) Component Invocations Input count Output count 0.00 command.dedup 3 1 1 0.46 command.eval 60 100,010 100,010 0.00 command.fields 10 16 16 0.14 command.mvexpand 3 1 10,000 0.00 command.prededup 2 7 1 0.08 command.presort 1 10,000 10,000 0.00 command.rename 3 10,000 10,000 0.01 command.search 2 - 7 0.00 command.search.index 2 - - 0.00 command.search.calcfields 1 7 7 0.00 command.search.fieldalias 1 7 7 0.00 command.search.filter 1 - - 0.00 command.search.index.usec_1_8 398 - - 0.00 command.search.index.usec_512_4096 1 - - 0.00 command.search.kv 1 - - 0.00 command.search.rawdata 1 - - 0.00 command.search.lookups 1 7 7 0.00 command.search.summary 2 - - 0.00 command.search.tags 1 7 7 0.00 command.search.typer 1 7 7 0.04 command.sort 1 10,000 10,000 0.16 command.table 1 10,000 20,000 0.00 dispatch.check_disk_usage 1 - - 0.00 dispatch.createdSearchResultInfrastructure 1 - - 0.10 dispatch.emit_prereport_files 1 - - 0.40 dispatch.evaluate 1 - - 0.40 dispatch.evaluate.search 1 - - 0.00 dispatch.evaluate.eval 20 - - 0.00 dispatch.evaluate.dedup 1 - - 0.00 dispatch.evaluate.fields 3 - - 0.00 dispatch.evaluate.mvexpand 1 - - 0.00 dispatch.evaluate.rename 1 - - 0.00 dispatch.evaluate.sort 1 - - 0.00 dispatch.evaluate.table 1 - - 0.45 dispatch.fetch 3 - - 0.01 dispatch.localSearch 1 - - 0.37 dispatch.preview 1 - - 0.17 dispatch.preview.command.table 1 10,000 20,000 0.08 dispatch.preview.command.presort 1 10,000 10,000 0.05 dispatch.preview.command.sort 1 10,000 10,000 0.01 dispatch.preview.write_results_to_disk 1 - - 0.00 dispatch.results_combiner 3 - - 0.01 dispatch.stream.local 2 - - 0.19 dispatch.timeline 3 - - 0.02 dispatch.writeStatus 7 - - 0.06 startup.configuration 1 - - 0.58 startup.handoff 1 - - ... View more

one more question, is it possible to explain your search query a little bit... so i could learn something? thanks ... View more

sorry i read this but it didnt answer my question... ... View more

Wow many thanks, i am glad! it works perfectly, you are the best!!! 🙂 ... View more

i have nearly the same problem, did someone have a answer? thanks ... View more

Hey, on that matter that there is no SamAccountName in the Event 4624 i chanched the header in my AD_Admins.csv from SamAccountName to user. And you are right about the transaction, it was a relict from a recent search where a tried to find de correlate logoff Event. Finally you brought me to the final version, thank you so much for that! this is my final version: index=wineventlog sourcetype=WinEventLog:Security EventCode=4624 (Logon_Type=2 OR Logon_Type=10 ) | fields _time, Logon_Type, host, EventCode, user | eval Date=strftime(_time, "%Y/%m/%d") | eval LogonType=case(Logon_Type="2", "Local Console Access", Logon_Type="10", "Remote Desktop via Terminal Services") | dedup user host _time | convert timeformat="%d/%m/%y %H:%M:%S" ctime(_time) AS "Date Time" | lookup AD_Admins user OUTPUT user | where user not null | table host, user, LogonType, Date, "Date Time" What do you think about the where clause? Because without that, the lookup is useless. (the lookup just overwrite the user field but the Event is still in the result table, if a Event occures from a user which is not in the AD_Admins.csv) Thank you so much ... View more

Thanks for that! I would like to know which hardware do you have in use. Anyway my search is still very slow! Mayby i made some mistake, can someone look at my search and give me an answer if it is correct. csv file AD_Admins with one column: SamAccountName adm1 adm2 adm3 ... ... the following search takes at least 10minutes: index=wineventlog sourcetype=WinEventLog:Security EventCode=4624 (Logon_Type=2 OR Logon_Type=10) | lookup AD_Admins SamAccountName OUTPUT SamAccountName as user | eval Date=strftime(_time, "%Y/%m/%d")| eval LogonType=case(Logon_Type="2", "Local Console Access", Logon_Type="10", "Remote Desktop via Terminal Services")| transaction host user startswith=EventCode=4624 | dedup user _time | sort - _time | convert timeformat="%d/%m/%y %H:%M:%S" ctime(_time) AS "Date Time" | table host, user, LogonType, Date, "Date Time" the same search but without the lookup takes at maximum 40 seconds: sourcetype=WinEventLog:Security EventCode=4624 (Logon_Type=2 OR Logon_Type=10) (Account_Name=adm1 OR Account_Name=adm2 OR Account_Name=adm3 OR Account_Name=adm4 OR Account_Name=adm5 OR Account_Name=adm6 ) | sort - _time | eval Date=strftime(_time, "%Y/%m/%d")| eval LogonType=case(Logon_Type="2", "Local Console Access", Logon_Type="10", "Remote Desktop via Terminal Services")| transaction host user startswith=EventCode=4624 | dedup user _time | convert timeformat="%d/%m/%y %H:%M:%S" ctime(_time) AS "Date Time" | table host, user, LogonType, Date, "Date Time" Thank you so much, i havnt any more ideas ... View more

ok, thanks that much is clear, but what about the performance? is it similiar to do a lookup, a inputlookup or a subsearch to a different index? i realised that i have approximately 300.000 4624 generally Events (LogonType 3), just 10 Events what i am interested in (LogonType 2, 10) and 45 Users in my csv file to corellate. And at this time my search is very slow!! Thanks ... View more