Hi All, Need help in the Duration filter. Code:    index=opennms "ciscoLwappApIfUpNotify" OR "ciscoLwappApIfDownNotify" | rex field=eventuei "ciscoLwappApIf(?<Status>.+)" | stats max(_time) as Time latest(Status) as Status by nodelabel | where Status="DownNotify" | fieldformat Time=strftime(Time,"%Y-%m-%d %l:%M:%S") | eval Downtime = now() - Time | eval Downtime = tostring(Downtime, "duration") | rex field=Downtime "(?P<Downtime>[^.]+)" | table nodelabel, Status, Downtime, Time     Sample output:  nodelabel Status Downtime Time USBTNBTECE DownNotify 0:12:02 12/9/2020 2:36 USJOLWLC DownNotify 1:31:21 12/9/2020 2:17 USMBP DownNotify 2:08:25 12/9/2020 1:39   Requirement is.:  Filter/remove all those values less than 1 hr Downtime. Tried all possibilities  "| where duration >3600"  but no output coming when giving this. Please suggest a solution.  ... View more

HI All, am having trouble getting below table in monthly order. please help me in this.  Query :    index=moogsoft_e2e | bin span=1mon _time | eval month_Year = strftime(_time,"%b-%y") | chart count over Class_Type by month_Year     Output tabular format :  Class_Type Aug-20 Jul-20 Sep-20 NodeDown  2168 2249 2027       Please help in chronology order ... View more

HI All, Need help in preparing a tabular form. Data am having :  using the Index am getting below table. Class Count NODEDOWN 520 BGPDOWN 320 ISISALERT 130   Query am using   index=itsm stats count by Class   Last 60 days data.   Requirement:  I want month wise data. I used timewrap and timechart.  But the data am getting is not the correct format.   Expected format output. Class Jul-20 Aug-20 Sep-20 NODEDOWN 250 250 20 BGPDOWN 150 150 20 ISISALERT 50 50 30   Please help me this format,  If it search for 1 year data. all 12 months in tabular data. ... View more

Hi all, need help in converting the time format. I want to add another 10.5 hrs to the submit date. Below query i tried and failed.   1. | eval Time=strftime(Submit_Date+10.5*3600,"%Y-%m-%d %l:%M:%S %p") 2. | fieldformat Time=strftime(Submit_Date+10.5*3600,,"%Y-%m-%d %H:%M:%S")     Complete code is below.   | dbxquery connection="ITDW" shortnames=true query="SELECT GETDATE() as 'CurrentTime', [Incident_Number], INC.[Company], [Customer], [Summary], [Notes], [Service], [CI], [Impact], [Urgency], [Priority], [Incident_Type], [Assigned_Support_Group], [Assigned_Support_Organization], [Status], [Status_Reason], [Resolution], [Reported_Date], [Responded_Date], [Closed_Date], [Last_Resolved_Date], [Submit_Date], [Last_Modified_Date], [Owner_Group] FROM [shared].[ITSM_INC_MAIN] INC LEFT OUTER JOIN [shared].[ITSM_CMDB_People_Main] PPL ON INC.Customer_ID = PPL.Person_ID WHERE ([Assigned_Support_Group] = 'Ops-WAN and LAN Incidents') AND [Submit_Date] BETWEEN DATEADD(D,-3,GETDATE()) AND GETDATE()" | table Customer, Incident_Number, Submit_Date     How can i edit the time in dbxquery, please help in that. when ever I try strftime, the output is coming blank without no value. ... View more

Hi All, need your help in getting the count correct for the below table. Table:  Time sitecode count 2020-08-21 FAW 1 2020-08-21 FAW 1 2020-08-21 FAW 1 2020-08-21 FAW 1 2020-08-21 FAW 1   Query:      index=moogsoft_e2e | eval Time = _time | fieldformat Time=strftime(Time,"%Y-%m-%d") | sort - Time | stats count by Time, sitecode       Expected output:  Time sitecode count 2020-08-21 FAW 5 ... View more

Hi All, need help in 2 regex problem. 1. Filtering Class_Type value from the  _raw .   "Ticket_ID": "8158", Please see Work Detail for all Alerts associated with this Incident ID\n-----------------------------------------------------------------\nTHPSL- : Node is down.\nClass: NodeDown Trap\nHost: THPSL-\nAlertID: 46141249\nSource Tool: OpenNMS\n-------------------------\nThe Moogsoft situation id = 999790\n\nSituationID from Moogsoft = https://moogui.na.xom.com/#/situation/999790     I use below regex which worked in https://regex101.com/  , but am not getting the exact output in splunk query | rex field=_raw "Class:\s(?<Class_Type>[^\\]+)"   2. _raw having 2 Class_Type field.   ""Ticket_ID"": ""1395"", Please see Work Detail for all Alerts associated with this Incident ID\n-----------------------------------------------------------------\nPGPLNGH1- : Node is down.\nClass: NodeDown Trap\nHost: PGPLNGH1-\nAlertID: 45744967\nSource Tool: OpenNMS\n-------------------------\nPlease see Work Detail for all Alerts associated with this Incident ID\n-----------------------------------------------------------------\nPGPLNGH4-: Operational status Down on interface ifname:Gi0/28 ifindex:10128 ifdescr:GigabitEthernet0/28 ifalias:iLi to PGPLNGH1-:Gi0/28\nClass: Custom Trap\nHost: PGPLNGH4-\nAlertID: 45748120\nSource Tool: OpenNMS\n-------------------------\nThe Moogsoft situation id = 973750\n\nSituationID from Moogsoft = https://moogui.na.xom.com/#/situation/973750"     how can i get both Class_Type field in Splunk output. Sample output. Class_Type Custom Trap NodeDown Trap ... View more

HI all, I have 2 index, that have same common field together.  I want to join both together. Query 1:      index=opennms "uei.opennms.org/nodes/nodeUp" OR "uei.opennms.org/nodes/nodeDown" | rex field=eventuei "uei.opennms.org/nodes/node(?<Status>.+)" | stats max(_time) as Time latest(Status) as Status by nodelabel | table nodelabel, Status, Time     Query 2 :      index=itsm sourcetype=remedy_midtier | rename _time as Time | fieldformat Time=strftime(Time,"%Y-%m-%d %l:%M:%S %p") | table nodelabel, Incident_Number, Time     Output table 1:  nodelabel Status Time CASCO Up 2020-08-07 5:45:28 PM AERIB Up 2020-08-07 5:30:05 PM CNPYU Up 2020-08-07 5:34:41 PM Output Table 2:  nodelabel Incident_Number Time CASCO INC000013850038 2020-08-07 5:45:28 PM CNPTT INC000013850032 2020-08-07 5:34:42 PM CNPYU INC000013850032 2020-08-07 5:34:41 PM    expected output:  nodelabel Incident_Number Status Time CASCO INC000013850038 UP 2020-08-07 5:45:28 PM CNPTT INC000013850032   2020-08-07 5:34:42 PM CNPYU INC000013850032 UP 2020-08-07 5:34:41 PM   I used join inner command but it failed. please help me in the join function. here nodelabel should be the common factor. ... View more

Hi All,   Need help in getting the data for those Downtime > 15 mins. below is the query am using.     index=opennms "uei.opennms.org/nodes/nodeUp" OR "uei.opennms.org/nodes/nodeDown" | fieldformat Time=strftime(Time,"%Y-%m-%d %l:%M:%S %p") | sort- Time | eval Downtime = tostring(now() - Time, "duration") | rex field=Downtime "(?P<Downtime>[^.]+)" | table Hostname Status Classification "Site Code", sitename, Time Downtime       output:  Device name Down Bronze LHC Luanda 2020-08-05 2:02:40 PM 00:14:45   ... View more

Hi all, I need help in changing an output that getting from below search to be changed.     index=itsm | stats count by Class_Type | sort - count     Output that results is:  Class_Type count NodeDown Trap 2129 Cisco LWAPP AP Trap 766   Can i change the output and reflect another name in the section. Like i want "Cisco LWAPP AP Trap" to be displayed as "CISCO AP DOWN" is that possible. ... View more

HI All, need your help in below query. I use below query to get below output. Query :  index=nw_syslog | rex field=_raw "neighbor\s(?<Alarm>[^\s]+)\s(?<Status>[^\s]+)" | stats max(_time) as Time latest(Status) AS Status count by nodelabel Alarm Output:  nodelabel Alarm Time Downtime Status count CMDLA 10.207.31.222 2020-07-13 15:18:55 00:03:00 UP 2 NGQIT 10.201.68.17 2020-07-13 15:06:35 00:15:19 DOWN 6 EGCAI 158.29.241.86 2020-07-13 14:48:33 00:33:21 UP 2 MXMXC 10.253.208.70 2020-07-12 14:48:03 1+00:33:51 UP 1 Problem :  I want only output for below conditions.   > All DOWN must show.   > UP with only greater than 2 must be shows. Please help me with the comparing search for this condition. ... View more

HI All, I need your help in getting a value set for a particular keyword matching 2 parameters with eval statement. Below is  my query.     index=itsm ~truncated~ | eval CRITICAL=if(Impact="1-Extensive" AND Urgency="1-Critical",1,0) | eval CRITICAL=if(Impact="2-Significant" AND Urgency="1-Critical",1,0) | eval CRITICAL=if(Impact="1-Extensive" AND Urgency="2-High",1,0) | eval HIGH=if(Impact="2-Significant" AND Urgency="3-Medium",1,0) | eval HIGH=if(Impact="2-Significant" AND Urgency="4-Low",1,0) | eval HIGH=if(Impact="2-Significant" AND Urgency="2-High",1,0) | eval HIGH=if(Impact="1-Extensive" AND Urgency="3-Medium",1,0) | eval HIGH=if(Impact="1-Extensive" AND Urgency="4-Low",1,0) | eval MEDIUM=if(Impact="3-Moderate" AND Urgency="1-Critical",1,0) | eval MEDIUM=if(Impact="3-Moderate" AND Urgency="2-High",1,0) | eval MEDIUM=if(Impact="3-Moderate" AND Urgency="3-Medium",1,0) | eval MEDIUM=if(Impact="4-Minor" AND Urgency="1-Critical",1,0) | eval MEDIUM=if(Impact="4-Minor" AND Urgency="2-High",1,0) | eval LOW=if(Impact="3-Moderate" AND Urgency="4-Low",1,0) | eval LOW=if(Impact="4-Minor" AND Urgency="4-Low",1,0) | eval LOW=if(Impact="4-Minor" AND Urgency="3-Medium",1,0) | table Incident_Number, Impact, Urgency, CRITICAL, HIGH, MEDIUM, LOW       I will get Incident_Number, Impact and Urgency from the index. I tried above combination, but am not getting exact value.   CRITICAL, HIGH, MEDIUM, LOW : are the combination of impact and urgency.   below is the table that am looking for. please help me with this.   Incident_Number Impact Urgency CRITICAL HIGH MEDIUM LOW INC000013677484 4-Minor 4-Low 0 0 0 1 INC000013677686 2-Significant 2-High 0 1 0 0 ... View more