Hi everyone, I have the following event format: _time logindate logoutdate userid 2019-07-25 09:41:21 25/07/2019 09:41:21 25/07/2019 13:47:52 USER1 2019-07-25 09:41:02 25/07/2019 09:41:02 25/07/2019 11:43:17 USER2 2019-07-25 09:39:56 25/07/2019 09:39:56 25/07/2019 13:01:17 USER4 2019-07-25 09:39:45 25/07/2019 09:39:45 25/07/2019 11:39:58 USER3 2019-07-25 09:39:15 25/07/2019 09:39:15 25/07/2019 10:32:34 USER2 2019-07-25 09:38:04 25/07/2019 09:38:04 25/07/2019 11:39:07 USER1 logindate and _time have the same value, because splunk considered the logindate field as the event _time automatically. What I need to accomplish is to count distinctively the number of users that were logged in at the same time. I have studied the concurrency command, but I don't think it solves my problem since I need to count distinct users. I was able to solve this in SQL (where these values are acctualy stored) by creating an auxliary table with just timestamps ranging from the earliest logindate to the latest logout date, incremented by the hour and then inner joining that table to data table whenever the timestamp from the dummy table was between logindate and logoutdate. Could I accomplish something similar or better in Splunk? ... View more

Hello Everyone. I have a search that uses streamstat to create a field called "answer" and "frequency" for each resulting event. Each of these events has another field, called "app", which is the applicaction that generated that event. I also use "dedup" command to get only the last event generated by each application, resulting in something like this: app=APP1;anwser=123;freq=159 app=APP2;anwser=456;freq=77 app=APP3;anwser=789;freq=44 app=APP4;anwser=112;freq=332 I want to create a simple table that has as columns the name of the application (from the "app" field) and as values (lines) of the table, the answer and the freq, like this: APP1 APP2 APP3 APP4 answer 123 456 789 112 freq 159 77 44 332 What I've done so far is this: mysearch | table answer,frequency | transpose | rename "row 1" as APP1, "row 2" as APP2, "row 3" as APP3, "row 4" as APP4 Which does the trick, but would be perfect if I could rename the automatically created rows by the transpose command with the values of the "app" field. Is it possible to do that or is there a better way to create such table? Thanks! ... View more

Hello everyone. I'm using "eventstats" to generate the average of a certain field in every event that Splunk collects, something like this: host=host1 index=itcam app=* | eventstats avg(answer) as answer_avg by app The result is something like this: 11/26/14 12:00:00 host='host1';app='app1';answer=90.00;answer_avg=80 11/26/14 11:50:00 host='host1';app='app2';answer=5.00;answer_avg=5.6 11/26/14 11:40:00 host='host1';app='app3';answer=10.00;answer_avg=11 11/26/14 11:30:00 host='host1';app='app1';answer=80.00;answer_avg=80 11/26/14 11:20:00 host='host1';app='app2';answer=4.00;answer_avg=5.6 11/26/14 11:10:00 host='host1';app='app3';answer=12.00;answer_avg=11 11/26/14 11:00:00 host='host1';app='app1';answer=70.00;answer_avg=80 11/26/14 10:50:00 host='host1';app='app2';answer=8.00;answer_avg=5.6 11/26/14 10:40:00 host='host1';app='app3';answer=11.00;answer_avg=11 Which works great, because I have the average answer per "app" field in every event. What I need to do now is calculate how long the current event took to occur based on the previous event, also separated by the "app" field. For example, in the above result, latest event is from "app1", which ocurred at "12:00". The previous event of "app1" ocurred at "11:30", which means that the latest event from "app1" (at 12:00) took 30 minutes since the last one (at 11:30). I would like to create a field, called "delay" (for example) in every event, including the latest one, with the time difference in seconds (or minutes) between an event and it's predecessor PER APP, resulting in something like this: 11/26/14 12:00:00 host='host1';app='app1';answer=90.00;answer_avg=80;delay=1800 11/26/14 11:50:00 host='host1';app='app2';answer=5.00;answer_avg=5.6;delay=1800 11/26/14 11:40:00 host='host1';app='app3';answer=10.00;answer_avg=11;delay=1800 11/26/14 11:30:00 host='host1';app='app1';answer=80.00;answer_avg=80;delay=1800 11/26/14 11:20:00 host='host1';app='app2';answer=4.00;answer_avg=5.6;delay=1800 11/26/14 11:10:00 host='host1';app='app3';answer=12.00;answer_avg=11;delay=1800 11/26/14 11:00:00 host='host1';app='app1';answer=70.00;answer_avg=80;delay=1800 11/26/14 10:50:00 host='host1';app='app2';answer=8.00;answer_avg=5.6;delay=1800 11/26/14 10:40:00 host='host1';app='app3';answer=11.00;answer_avg=11;delay=1800 In this poor example, every app took exactly 30 minutes (or 1800 seconds) to execute. Thanks in advance!! ... View more