I'm trying to extract logname from the following.  So the logname value would be message.log/bblog.log/api.log Please Note :  When the timestamp date is between10-31 there is no extra space where when the timestamp date is single digit i.e.,(1-9 ) there is an extra space at the beginning of the event. ex: <10>Jan<space><space>4 15:30:02        <10>Dec<space>31 15:30:02 Here are the sample events  <10>Jan  4 15:30:02 a2222xyabcd031.xyz.com app1001-cc-NONPROD 2023-01-04 15:30:02 message.log INFORMATION apple:73 dev-banana_Guava-[Messaging.Security] [sys] [THE Outbound | outbound|] claimEligibility=false   <10>Jan  4 15:30:02 ia2222xyabcd031.xyz.com app1001-cc-NONPROD 2023-01-04 15:30:02 bblog.log INFORMATION apple:73 dev-banana_Guava-[Messaging.Security] [sys] [THE Outbound | outbound|] claimEligibility=false   <10>Dec 31 15:30:04 a2222xyabcd031.xyz.com app1001-cc-NONPROD 2023-01-04 15:30:04 api.log INFORMATION apple:73 dev-banana_Guava-[Messaging.Security] [sys] [THE Outbound | outbound|] claimEligibility=false ... View more

The following event being parsed as single event. I'm trying to break the event into multiple events Sample data Timestamp: 2021.09.21 - 23:10:17.463 Message: c0d8758b-3fxy-44ca-aa65-hf180002d499 Organization Name: bananaII UserId: systemuser AppTracking: abcd2400-34ac-50el-3456-4abcd7636 ------------------- CommonMessageInput ---------------- Timestamp: 2021.09.21 - 23:10:17.463 Message: c0d8758b-3fxy-44ca-aa65-hf180002d499 Organization Name: bananaII UserId: systemuser AppTracking: abcd2400-34ac-50el-3456-4abcd7636 ------------------- CommonMessageInput ---------------- Timestamp: 2021.09.21 - 23:10:17.463 Message: c0d8758b-3fxy-44ca-aa65-hf180002d499 Organization Name: bananaII UserId: systemuser AppTracking: abcd2400-34ac-50el-3456-4abcd7636 I'm trying to break the event before ------------------- CommonMessageInput ---------------- so the events will be  Event 1 Timestamp: 2021.09.21 - 23:10:17.463 Message: c0d8758b-3fxy-44ca-aa65-hf180002d499 Organization Name: bananaII UserId: systemuser AppTracking: abcd2400-34ac-50el-3456-4abcd7636 Event 2 ------------------- CommonMessageInput ---------------- Timestamp: 2021.09.21 - 23:10:17.463 Message: c0d8758b-3fxy-44ca-aa65-hf180002d499 Organization Name: bananaII UserId: systemuser AppTracking: abcd2400-34ac-50el-3456-4abcd7636 Event 3 ------------------- CommonMessageInput ---------------- Timestamp: 2021.09.21 - 23:10:17.463 Message: c0d8758b-3fxy-44ca-aa65-hf180002d499 Organization Name: bananaII UserId: systemuser AppTracking: abcd2400-34ac-50el-3456-4abcd7636   ... View more

Hello,  I have onboarded the data into Splunk which we have multiple timestamps in the event in different formats. I believe my props settings are correct however it's giving an error in Splunkd.log. Please Advise Error Details : DateParserVerbose [99999 merging_0] - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (16) characters of event. Defaulting to timestamp of previous event Event Details:  Jul 10 14:19:08 abcdefgh81 dnsmask Jul 10 14:19:08 dnsmask[1520]: cached abcdefg43.wellness.com is 10.220.200.72 Jul 10 14:19:08 abcdefgh81 dnsmask -- [10/July/2022:18:10:10 -9900] dnsmask[1520]: cached abcdefg43.wellness.com is 10.220.200.72 Here are my props settings TIME_PREFIX=^ TIME_FORMAT=%b %d %H:%M:%S MAX_TIMESTAMP_LOOKAHEAD = 16     ... View more

Hello Splunkers,  I've an issue with my event time configuration. It has incorrect timestamp. Below are my props settings..it doesn't seem to be working. Please Advise TIME_FORMAT = %Y-%m-%d %H:%M:%S TIME_PREFIX = ^ TZ = UTC-4 MAX_TIMESTAMP_LOOKAHEAD = 20    Sample log format Time                                                                      Event 6/27/21 8:30:56.000 PM                #Software: banana Internet Information Services 19.0                                                                    #Version: 10.0                                                                    #Date: 2021-06-27 20:32:46                                                                    #Fields: Sacramento is the capital of California 6/27/21 8:30:56.000 PM                 #Software: pineapple Internet Information Services 39.0                                                                     #Version: 12.0                                                                     #Date: 2021-06-27 20:32:46                                                                     #Fields: Austin is the capital of Texas     ... View more

Hello Splunk Community, I've a query which lists accountNumber , targetAccountNumber, eventType, eventTime The query is working just fine..but it is displaying empty rows with eventTime being displayed accountNumber   targetAccountNumber    eventType      eventTime 123456                         789123                               apple               09/02/2020:12:00                                                                                         banana           09/02/2020:13:00   111111                        763333                                 mango               09/03/2020:15:00                                                                                        watermelon       09/03/2020:16:00   212121                         999999                              Texas                   09/04/2020 :18:00                                                                                                                        09/04/2020:19:00                                                                                                                       09/04/2020:20:00                                                                                                                       09/04/2020:21:00 I do not want the empty eventTime being displayed. It should display only there is an eventType for particular time. How should I exclude the empty eventTime My query is as follows index=newyork data | stats values(eventType) as eventTypes,values(eventTime) as "Event Time" by accountNumber, targetAccountNumber   Please help                                                                                                                         ... View more

I've a query which has column like AccountNO eventType _time and difference I'm trying to find the time difference of each eventType(there are 13 eventTypes), I'm following an algorithm and able to get the time difference of these 13 event types. Now my result looks like this AccountNO         eventType                _time                                        difference 123456789       eventType1            1/1/2021:12:00:00                                 eventType2            1/1/2021:12:01:20                                 eventType3            1/1/2021:12:03:00                                 eventType4            1/1/2021:12:04:00                                  eventType5            1/1/2021:12:08:00                                  eventType6            1/1/2021:12:12:00                                   eventType7            1/1/2021:12:13:00                                  eventType8              1/1/2021:12:14:50                                  eventType9              1/1/2021:12:16:00                                 eventType10             1/1/2021:12:18:00                                  eventType11            1/1/2021:12:19:00                                  eventType12             1/1/2021:12:21:30                                   eventType13             1/1/2021:12:23:00 I used eval and formula to get the difference of 13 eventTypes like D1,D2,D3,D4,D5,D6,D7,D8,D9,D10,D11,D12,D13 Now I want to map these D1 to D13 values in difference field/column. So that my result will be like below. I guess it has something to do with CASE Statement but it's not working for me. Please help AccountNO            eventType                  _time                                                 difference 123456789            eventType1              1/1/2021:12:00:00                         00:00                                      eventType2              1/1/2021:12:01:20                         01:20                                      eventType3                1/1/2021:12:03:00                       01:40                                      eventType4                1/1/2021:12:04:00                       01:00                                      eventType5                 1/1/2021:12:08:00                      07:00                                      eventType6                  1/1/2021:12:12:00                      02:00                                      eventType7                   1/1/2021:12:13:00                      03:20                                       eventType8                   1/1/2021:12:14:50                    02:00                                       eventType9                     1/1/2021:12:16:00                    01:00                                       eventType10                    1/1/2021:12:18:00                   02:00                                      eventType11                    1/1/2021:12:19:00                    01:00                                       eventType12                     1/1/2021:12:21:30                   02:00                                       eventType13                     1/1/2021:12:23:00                     04:00 ... View more

Hello Splunk Community I'm working on a SPL to give _time difference of list of eventTypes as per the algorithm. Currently I'm using the below query. index=apple source=datapipe AccountNumber=* eventType=newyork          OR                               eventType=california         OR                             eventType=boston             OR                             eventType=houston           OR                            eventType=dallas                OR                         eventType=austin               OR                           eventType=Irvine                OR                        eventType=Washington      OR                      eventType=Atlanta               OR                       eventType=San Antonio      OR                  eventType=Brazil                   OR                  eventType=Mumbai              OR                      eventType=Delhi                    OR                    |fieldformat _time=strftime(_time,"%m/%d/%Y%I:%M:%S %p") |sort by AccountNumber,_time |streamstats  range(_time) as diff window=2 |eval DifferenceInTimeByEventtime=strftime(diff,"%M:%S") |table AccountNumber eventType _time DifferenceInTimeByEventtime The query is working..However I need the time difference as per the algorithm. NOT ONLY as per the previous event .The algorithm is as follows A    eventType=newyork                                    B    eventType=california            B-A                         C    eventType=boston                C-B                                  D    eventType=houston             D-C                                 E     eventType=dallas                  E-D                     F     eventType=dallas                   F-D                    G     eventType=Irvine                 G-E                        H     eventType=Irvine                  H-F        I      eventType=Atlanta                I-H                       J    eventType=San Antonio         J-I                  K   eventType=San Antonio         K-I                              L    eventType=Mumbai               L-I                     M   eventType=Delhi                    M-I I'm looking for a _time difference according to the algorithm above Add Avg,Max,Min column to the search     I would appreciate if there is a query optimization Thanks in Advance. ... View more

I have the data with different event types in the data say A to M.. Wanted to find time diffrence which tookfor each event Example index=apple source=datapipe eventType=newyork                                   A eventType=california                                  B     B-A eventType=boston                                       C    C-B eventType=houston                                    D    D-C eventType=dallas                                        E      E-D eventType=austin                                        F     F-D eventType=Irvine                                         G    G-E eventType=Washington                            H    H-F eventType=Atlanta                                      I        I-H eventType=San Antonio                          J         J-I eventType=Brazil                                       K          K-I eventType=Mumbai                                   L       L-I eventType=Delhi                                        M        M-I Currently I'm using |streamstats range(_time) as diff window=2 ..however it gives the sequential order of the difference. I want the difference in time in the above format The eventTypes are Unique and I'm using append in my search in each eventType @sundareshr @ITWhisperer @Nisha18789 @MuS @jasongb @yuanliu @thetech @guilmxm  Thank you ... View more

Hello Splunk Community, I have 2 reports trying to combine into 1. The fields are different to each other. Say Report 1 has field1,field2,field3,field4,field5 and Report2 has field6, field,7, field8,field9 Report 1 uses weekly time range earliest=-1w@w latest=@w1 Report 2 uses Year to date time range earliest=@y latest=@w1 I tried using append,appedcols and join but the values are messing up and not lined up together Please help ... View more