Both @thambisetty  and @renjith_nair  have made good suggestions (although @thambisetty  does need a minor tweak to account for more than 9 students (use "s/student\d+\: and so on) and @renjith_nair  could use @thambisetty 's technique for capturing the initial part of the expected output, and both are missing the space after the ":" - these are minor details). However, both are based on the not unreasonable assumption that Field2 contains all and only the names in the required order and @thambisetty  also assumes, again not unreasonably, that your events really do have students listed as student1, student2 etc. and not some student id. Please confirm that this is true and, if so, accept a solution. ... View more

Depending on what your data actually looks like, extracting a single value might be just as easily achieved with rex ... View more

Set your time period so that it aligns to the month then add a day (or two)  @mon+1d ... View more

Splitting into bytes is easy enough to do ... | rex field=phyPayload "(?<byte1>\S{2})(?<byte2>\S{2})... Converting to numbers easy enough to do ... | eval b1=tonumber(byte1,16) | eval b2=tonumber(byte2,16) ...  Bitwise operations  apart from shift (multiply or divide by powers of 2 and modulus) not so easy, so it depends what operations you need and whether they can be turned into maths equations. ... View more

Still not clear what your search is. However, can you use spath to extract the phyPayload ... | spath output=phypayload path="phyPayload" ... ... View more

Please can you provide some sample data and the search(es) you have tried ... View more

The fact that you are not getting any events has nothing to do with the rex, your base search index=linux host=* source=ps sapstasrtsrv is not returning any events for the 24 hour time period you specified. Fix this and reapply the rex   ... View more

Try something like this: index=test (sourcetype=splunk_log event=AUTHN_ATTEMPT clientId=web status=inprogress) OR (source="server.log" "In processPasswordCredential" "found and success") | rex field=_raw "sessionid\=\"id\:(?<id>[^\"]+)" | eval timeofsuccess=if(like(_raw, "%found and success%"),_time,NULL()) | stats values(clientId) as clientId, values(timeofsuccess) as _time by id | fillnull value="ignore" clientId, _time | where clientId != "ignore" AND _time != "ignore" | bin span=1h _time | stats count by _time I am not sure if the fillnull on _time is required ... View more

If you are only interested successful attempts, why are you bothering with the first search or extracting id? index=test source="server.log" "In processPasswordCredential" "found and success" | bin span=1h | stats count by _time ... View more

Have you tried the join command to link the two queries by ip? ... View more

I meant mark my post as the solution not yours! Give credit where credit is due  😀 ... View more

@VS0909 Please can you accept the solution so others can find it more easily ... View more

Please can you mark it as solved to help others find it ... View more

| stats count by Field1 | eval count1=if(Field1="yes",count,NULL()) | eval count2=if(Field1="no",count,NULL()) | fields count1, count2 | stats values(*) as * | eval ratio=count1/count2 ... View more

I don't know these logs or events but from your description it seems to me that you need the value of State for the latest event for each Message (which you have already looked up) so how about trying this | stats latest(_time) as Date values(State) as State by host Short_Description | sort - host Date ShortDescription Could you also do the lookup after the stats so there is less to look up?  ... View more

OK so you first need to work out which errors occur in each environment then count them index=dev OR index=prod "error" | rex "(?<error>some match to extract your error into a field)" | stats values(error) as error by index | stats values(index) as index, count by error | where count = 1 ... View more

Have a look at this old answer which might help you extract some fields, which you can then work with to determine which value you want to make the result since you haven't made that clear (except in a few specific examples). ... View more

@CaptainPiPoTron  You haven't explained how splunk can be told which product to use for each event. Do you want to code if event 5 result = Screw 11, if event 6 result = Screw9, etc.? Probably not, so what does "depending on event id" actually mean, how does splunk know which product to return? ... View more