Hello all, I was hoping I could get a bit of assistance in figuring out a rex expression I could use to extract part numbers that are in column, I have a sample data set below, part_num serial_num type abc 123 a bcd 234 a cde 456 b Essentially I'm trying to extract all the "part_num" and "serial_num" for "types" of "a", I can extract the first part that matches however I've been unable to figure out how I can extract all fields I need of type a for my events, essentially it would look like this (FYI, I already have the host machine serial number extracted) rex.... |stats list(part_num) as part_num list(serial_num) as serial_num by host_machine host_machine. part_num serial_num 981-aabbc abc 123 bcd 234 and this would display for all my machines. Thank you, and please let me know if there are any questions, I appreciate any help ... View more

Hello All, I have a set of data that looks like the excerpt below: [44] 2017-12-22 to 2017-12-29: 2017-12-22 (Fri) to 2017-12-29 (Fri) : rotation1 : [email protected] 2017-12-22 (Fri) and 2017-12-23 (Sat) : rotation2 : [email protected] 2017-12-23 (Sat) and 2017-12-24 (Sun) : rotation3 : [email protected] 2017-12-23 (Sat) and 2017-12-24 (Sun) : rotation4 : [email protected] 2017-12-25 (Mon) to 2017-12-29 (Fri) : rotation5 : [email protected] 2017-12-25 (Mon) to 2017-12-29 (Fri) : rotation6 : [email protected] 2017-12-25 (Mon) to 2017-12-29 (Fri) : rotation7 : [email protected] [email protected] And, I am able to extract each person on each rotation and create a list by table using the stats command which looks something like this: Person Rotation Dates [email protected] rotation1 2017-12-22 (Fri) to 2017-12-29 (Fri) This continues, and I get a table listing all the person's rotations for the year, however I run into an issue for rotation7 since there are usually 2 people on it, when I use mvzip for the rotation, dates and person It only picks up the first name, so it would look like rotation=(2017-12-25 (Mon) to 2017-12-29 (Fri) , rotation7, [email protected]), however what I need is for it to pick up the second name as well and zip it with the correct rotation as a separate entry. In other words, it would be the previous rotation I.E rotation=(2017-12-25 (Mon) to 2017-12-29 (Fri) , rotation7, [email protected]), and another event as rotation=(2017-12-25 (Mon) to 2017-12-29 (Fri) , rotation7, [email protected]). I have max_match=0, and I am expanding the events however I have not been able to figure this out, are the any suggestions? Thanks you! ... View more

Hi all, I am attempting to count the number of Installs of certain code levels for field machines. Essentially I am extracting this information from some logs, and then I am listing all the code levels by machine serial, this gives me the code level history of a machine. Where I am struggling is being able to list current installs of the code levels, so this would include counts of 0 since not all code levels are currently being used, however I feel that my current approach isn't appropriate , I've included some samples below. First part of Search- Search.......| stats values(code_level) as code_level list(time_on_machine) as time_on_machine by Machine_Serial | stats dc(Machine_Serial) as installs sum(time_on_machine) by code_level Results- Machine_Serial code_level time_on_machine 75abc 1.1 365 1.3 20 1.4 50 75dfe 1.1 10 1.3 15 1.5 7 75xyz 1.3 25 1.4 50 As mentioned above from this search I can see a historical view of the code history for machines as well as the time it spent on a machine. Essentially only the latest code level ( the one at the bottom of each group I.E the largest one ) would count as an install so for the first group ( serial 75abc ) code level 1.1 would be a current install, but 1.3 and 1.4 would not count towards installs on their respective level, however I do take their time_on_machine field and add that to the rest, so it would look something like this- Desired Results- code_level current_installs time_on_machine_sum 1.1 0 375 1.3 0 60 1.4 2 100 1.5 1 7 Is there any way I can achieve the current_installs portion of this search? Thank you in advance, and please let me know if something was not clear. ... View more

Hi all, I'm running a search which outputs something like this, ( where time_diff is the date the code was loaded, subtracted from the date the search is ran in days)- Machine_Serial Bundle time_diff 75BMY43 1.1 50 1.2 25 1.3 5 1.4 3 75RAB99 1.2 30 1.3 10 1.4 5 What I am trying to achieve is to take one time_diff then subtract the proceeding time_diff so the last two time_diff's in for Machine_Serial would be 50-25=25 then 25-5=20 and so forth, up until the most current which would be 3 ( nothing is done to this one since it is currently on this level and it should grow until another Bundle is loaded). I hope that by using this method I can get the amount of time that the Bundle was loaded on a machine, with out it growing. So it would look something like this Machine_Serial Bundle time_diff time_on_machine 75BMY43 1.1 50 25 1.2 25 20 1.3 5 2 1.4 3 3 75RAB99 1.2 30 20 1.3 10 5 1.4 5 5 Is there any way I can achieve this? Thank you and please let me know if there are any questions. ... View more

Hi all, I have the following search "result generating search"| eval z=mvzip(Bundle, Load_Time) | mvexpand z | streamstats window=2 current=f range(Load_Time) as time_diff by Machine_Serial| eval time_diff=if(isnull(time_diff), now()-Load_Time, time_diff)| eval timed=time_diff/86400 | stats dc(Bundle) as count values(Bundle) as Bundle values(_time) as time list(time2) as Date values(time_diff) as time_diff values(timed) as tim_diff(H) by Machine_Serial | sort 0 -num(tim_diff(H)) Which returns a table that looks something like this: Machine_Serial count Bundle time Date time_diff tim_diff(H) ____________________________________________________________________________________________ 75123 3 1.1 1458049413 2016/03/16 6702139.000000 1134.5710532407 1.3 1458053068 2013/04/2 98026939.000000 1135.5710532407 1.4 1464618084 2013/04/23 98113339.000000 77.57105324074 -------------------------------------------------------------------------------------------- 75334 1 1.5 1464788901 2012/10/17 114356539.000000 1323.57105324074 I've been trying to sort based on the values of time_diff(H) using the sort command, however, it doesn't seem to work on the values in the same under the same group, so they'll be mismatched internally. I've attempted various sort commands, as well placing it in different locations, but I haven't been able to crack it. Is there any I can achieve this? Thank you in advance. ... View more

Hello, I'm running the following search for a runtime report: my search | rex field=source ".*?(?<Machine_Model>9\d\d)" | where Machine_Model=961 | rex field=source ".*?9\d\d(?<Machine_Serial>\S{7})" | rex "(?:\n|.)\s+(?<BU1>\d+\.\d+\.\d+\.\d+)" max_match=0 | eval BU2=max(BU1) | rex "(?:\n|.).*?Package:\s+(?<Package>\S+)" | dedup BU2, Machine_Serial | stats dc(BU2) as count values(BU2) as BU2 values(_time) as time by Machine_Serial Which return results like these (for simplicity I've change the field values in the table) - Machine_Serial BU2 time _______________________________________ 1234 1.2 30 1.1 20 1.0 10 --------------------------------------- 1235 1.0 10 --------------------------------------- 1236 1.3 30 1.2 10 And I would like to calculate the difference between each time - in other words, the amount of time each machine remained on a code level with the latest being the difference between the date the search is ran (lets say today =50), so it would look something like this: Machine Serial BU2 time time_diff ___________________________________________________ 1234 1.2 30 20 1.1 20 10 1.0 15 5 -------------------------------------------------- 1235 1.0 10 40 -------------------------------------------------- 1236 1.3 30 20 1.2 10 20 Is there any way to achieve this? Thank you in advance. ... View more

Hi all, I'm using the Splunk Field Extractor in order clean up the my search a bit, and I'm using the following rex extraction which works fine from the search and even from the extraction preview, however, once I save it, it does not appear in my fields. Would anyone happen to know why this is? Thank you in advance | rex field=source ".*?(?<Machine_Model>9\d\d)" ... View more