About psmp

psmp · ‎12-10-2021

@isoutamo Thank you so much for replying and your time. So the bucket command puts all the results in groups of span value. which does not give us the accurate chart atleast in my case. I am trying to group the results based on span. If span is selected as 60 mins, So, can you suggest a best way to show the graph with buckets No of VM logged in for 1-5min intervals when span = 5mins. So the chart will show 100 vms were logged and had session_duration between 1min and 5 mins 200 machines were logged in and had session_duration between 5 to10 mins, 15 to 20 mins etc.. When span is set to 1h, Nof VMs logged in for 1h-2h, 2hrs to 3hrs etc.. eval session_duration=strptime(session_duration, "%H:%M:%S")| bucket session_duration $span_tok$ | fieldformat session_duration=strftime(session_duration, "%H:%M:%S")| chart count(vm_name) over session_duration Also, when you click on the chart, froom the above query, it leads to the search command appended with with "search session_duration="00:02:40"" and the results yield no data although we have results shown with that duration as 00:02:40 when run without the condition " search session_duration="00:02:40""

psmp · ‎12-10-2021

Great, That worked like a charm!! Thank you @isoutamo and @yuanliu for your time and help. However, I see session duration is coming in as a string. So I used below to show it in a chart using bucket command so I see no of machines logged for certain period of times like in span on 5min, 30min etc.. eval session_duration=strptime(session_duration, "%H:%M:%S")| bucket session_duration span=60m | chart count(vm_name) over session_duration Te first eval command convert session_duration to epoch. so the cart shows epoc time which is not readable. So I added fieldformat session_duration=strftime(session_duration, "%H:%M:%S") after te bucket command. But the data looks incorrect. For eg., 2021-12-10 13:29:35 2021-12-10 13:28:42 00:00:00 but expected to be: 2021-12-10 13:29:35 2021-12-10 13:28:42 00:00:53 Any clue?

psmp · ‎12-09-2021

Thank you both! I wasnt sure if my oiginal thread was active anymore. so created a new one. sorry for the trouble. you could archive or delete this post. i wil; travck my original post. thank you.

psmp · ‎12-09-2021

| makeresults | eval _raw = "user_name machine_name event_name logon_time user1 machine1 logon 12/9/2021 7:20 user1 machine1 logoff 12/9/2021 7:22 user1 machine1 logon 12/9/2021 8:20 user1 machine1 logoff 12/9/2021 8:22" | multikv forceheader=1 | eval _time = strptime(logon_time, "%m/%d/%Y %H:%M") ```| reverse``` | fields - _raw linecount | eval login_time = if (event_name == "logon", logon_time, null()), logout_time = if (event_name == "logoff", logon_time, null()) | transaction endswith=(event_name=logon) startswith=(event_name=logoff) user_name machine_name ```| transaction startswith=(event_name=logon) endswith=(event_name=logoff) user_name machine_name``` | eval session_duration = tostring (duration, "duration") | rename login_time as logon_time | table user_name machine_name event_name logon_time logout_time session_duration how do i repplace the below section of query with results from a query _raw = "user_name machine_name event_name logon_time user1 machine1 logon 12/9/2021 7:20 user1 machine1 logoff 12/9/2021 7:22 user1 machine1 logon 12/9/2021 8:20 user1 machine1 logoff 12/9/2021 8:22 my base query yields data like below wic needs go to _raw index=foo source = bar | fields user_name, macine_name, event_name, logon_time this query will result 1000s of rows that may look like belwo data user1 machine1 logon 12/9/2021 7:20 user1 machine1 logoff 12/9/2021 7:22 user1 machine1 logon 12/9/2021 8:20 user1 machine1 logoff 12/9/2021 8:22 I need to feed those thousands of events to _raw to makeresults. Any help is much appreciated. thanks

psmp · ‎12-09-2021

Error in 'transaction' command: This search requires events to be in descending time order, but the preceding search does not guarantee time-ordered events. I got the above error when trying to use the below query to use my search results into makeresults feed. my base query will yield very messy data like machine1 logged on at 12 machine 10 logged out at 10:01 and so on. | makeresults | append [ search index=foo sourcetype=bar source=foobar | table event_name, machine_name, user_name, user_type, _time| sort _time | eval _time = strptime(_time, "%m/%d/%Y %H:%M") ```| reverse``` | fields - _raw linecount | eval login_time = if (event_name == "logon", _time, null()), logout_time = if (event_name == "logoff", _time, null()) | transaction endswith=(event_name=logon) startswith=(event_name=logoff) user_name machine_name ```| transaction startswith=(event_name=logon) endswith=(event_name=logoff) user_name machine_name``` | eval session_duration = tostring (duration, "duration") | rename login_time as logon_time | table user_name machine_name event_name logon_time logout_time session_duration]

psmp · ‎12-09-2021

@isoutamo so if I use like this, how can i assign the fields to the _raw var so I can process it like you suggested? index=foo sourcetype=bar source=foobar [ | makeresults | .......

psmp · ‎12-09-2021

Your query looks super cool. how do i replace the info in raw data with my quer results? | eval _raw = "user_name machine_name event_name logon_time user1 machine1 logon 12/9/2021 7:20 user1 machine1 logoff 12/9/2021 7:22 user1 machine1 logon 12/9/2021 8:20 user1 machine1 logoff 12/9/2021 18:22" here instead of the raw data, can I replace my query?

psmp · ‎12-09-2021

@isoutamo Thanks for your reply. you have used actual data in make results ? Not sure if thats the best for my case as the data comes in dynamically to splunk for the DB Connect. I have managed to get the individual events as desired by using mv commands. | eval zipped=mvzip(mvzip(vm_name,event_name),event_time) | mvexpand zipped | eval data=split(zipped,",") |eval vm_name=mvindex(data,0) | eval action=if((mvindex(data,1) like "Logon"), "logon", "logout") | eval assign_time=if((mvindex(data,1) like "logon"), mvindex(data,2), "NA")|eval release_time=if((mvindex(data,1) like "logout"), mvindex(data,2), "NA") | streamstats window=1 current=f values(release_time) as machine_release_time by vm_name, user_name | streamstats window=1 current=f values(release_time) as machine_release_time by vm_name, user_name | where assign_time !="NA" OR machine_release_time!="NA" OR machine_release_time!=" " | where action="logon" | convert timeformat="%Y-%m-%d %H:%M:%S" mktime(assign_time) as assign_time_epoch | convert timeformat="%Y-%m-%d %H:%M:%S" mktime(machine_release_time) as machine_release_time_epoch |eval session_time=(machine_release_time_epoch-assign_time_epoch) | eval session_duration=tostring(session_time, "duration") However, now I m stuck to put this in a chart using bucket command. The span doesnt work as expected. my session_duration is of type string and it has values like 00.37.35, 02:45:30 and so on. I am trying to put the chart using buckets so I can see machines logged on for 1-5 mins, 30-1h, >2 hrs and so on. any google search for string to date and use in chart leads me to strptime and it doesnt work as expected. because it converts to epoch and the time is unreadable in chart visualization, any way I can show the graph with HH:MM:SS with buckets with different span like 5min , 30m 2h etc.. TIA

psmp · ‎12-08-2021

RAWDATA: user_name machine_name event_name logon_time user1 machine1 logon 12/9/2021 7:20 user1 machine1 logout 12/9/2021 7:22 user1 machine1 logon 12/9/2021 8:20 user1 machine1 logout 12/9/2021 8:22 From the above Data, I am trying to retrieve the individual session duration for each user and machine and put it in a chart. I have the query which renders the aggregate of the session for machine and user. . user_name machine_name event_name logon_time logout_time session_duration user1 machine1 logon 12/9/2021 7:20 12/9/2021 7:22 1:01:51 However, I am trying to retireve the session duration for each login that happened anytime. Desired result is : user_name machine_name event_name logon_time logout_time Sesssion_duration user1 machine1 logon 12/9/2021 7:20 12/9/2021 7:22 0:01:51 user2 machine1 logon 12/9/2021 8:20 12/9/2021 8:22 0:01:51 Could someone pls help me correct my query to get the each session by logon and logout events. TIA my query : index=foobar sourcetype=foo source=bar | dedup event_time | table machine_name, user_name, event_name, event_time | streamstats current=f last(event_time) as logout_time by machine_name | table , machine_name, user_name, event_name, event_time, logout_time | where event_name="LOGON" and logout_time!="" | eval type=typeof(logout_time) |eval logon_time=event_time | convert timeformat="%Y-%m-%d %H:%M:%S" mktime(logon_time) as assigned_at | convert timeformat="%Y-%m-%d %H:%M:%S" mktime(logout_time) as released_at | eval session_duration=(released_at-assigned_at) | eval session_duration=tostring(session_duration, "duration") | table user_type, user_name, site_id, machine_name, event_name, logon_time, logout_time, session_duration

psmp · ‎12-02-2021

Thank you @ITWhisperer How can I match the events that fall under this buckets? like Machine A-X will fall under 5-30min as they all have session times in that timerange. Thanks for your time and help.

psmp · ‎12-02-2021

I have a dhasboard which should show buckets with number of machines by span of time. Machine A to F is used for 2 mins Machines D-T was used for 2hrs Machine s-Z was used for more than 4hrs So my graph should show the buckets with time range as a standard set. XAxis <5 mins, 5-30mins 30min - 2hrs 2-4hrs > 4hrs YAxis No of machines logged on for <2mins No of machines logged on for 5-30mins and so on. Logon Time Logoff Time MachineName SessionTimeinMins 12/1/2021 19:33 12/1/2021 19:36 A 3 12/1/2021 16:46 12/1/2021 17:04 B 18 12/1/2021 15:35 12/1/2021 15:38 C 3 12/1/2021 11:35 12/1/2021 11:38 D 120 12/1/2021 16:35 12/1/2021 21:35 E 300 Base Search | bucket SessionTimeinMins span=20 | chart count(MachineName) by sessionSpan But this do not help in achieving what i wanted. Any help is much appreciated. Ho do I set my X-Axis to show standard buckets like <2min, 30-1h and bring the count into this bucket. Thanks

psmp · ‎07-31-2018

Hi DalJeanis, Thanks for your reply. But this gives only the installed Versions and still not displaying the missing hosts. I found another way of doing it. i calculated the no of hosts missing the softwares. If its greater than zero, I run a search which just displays the hostnames that do not have the software. Thanks! Also one more QQ. How do I edit the my question in answers.splunk.com??

psmp · ‎07-30-2018

I have a Dashboard which returns a table. the Drilldown is selected as Row for this table. There are 2 rows with DisplayVersion as 2.8.110 and NULL. When I click on the row with the DisplayVersion as 2.8.11.0, it opens a new window with base query that includes "search "DisplayVersion='2.8.11.0' " and return 223 rows. But When I click the row with DisplayVersion as NULL, it opens a new window with only the base query and still returns 223 rows. Ideally it should open the base query + "Search DisplayVersion = "" " and just display one row. But it is not happening so. Can someone please clarify why? Image attached for your reference.

psmp · ‎07-27-2018

Problem to solve: we have say 500 servers. out of 500 servers some servers have older versions of software installed. Some server are even missing the softwares. we are trying to list this in the report. SoftwareName Version NoOfhostwithsoftwareinstalled NoOfHostmissingSoftwares Listofhosts_thataremissing_softwares Software1 1.0 300 10 server1 software1 1.1 190 server2 ...... server10 I am trying to achieve this with the base search / postprocess. I am able to list first 4 columns. But Not able to list the servers missing package. <code> My dashboard XML: <dashboard> <label>Installed Softwares List</label> <search id="baseSearch"> <query>index=powershell source="powershell://CCT-InstalledSoftware" sourcetype=CCT_Software host ="UE1*A01" | dedup host, DisplayName, DisplayVersion</query> <earliest>-24h</earliest> <latest>now</latest> </search> <search base="baseSearch"> <query> | stats dc(host) as TotalNoOfHosts values(host) as allhostlist</query> <done> <condition> <set token="tokhost">$result.TotalNoOfHosts$</set> <set token="tokhostlist">$result.allhostlist$</set> </condition> </done> </search> <row> <panel> <search base="baseSearch"> <query>search DisplayName="software*" | stats dc(host) as HostsWithPackage values(host) as packlist </query> <done> <condition> <set token="tokpack">$result.HostsWithPackage$</set> <set token="tokpacklist">$result.packlist$</set> </condition> </done> </search> <table> <title>List of Hosts with Package</title> <search base="baseSearch"> <query>search DisplayName="software1*" | rex "DisplayVersion=(?<versionD1>\d+)" | rex "DisplayVersion=\d+.(?<versionD2>\d+)" | rex "DisplayVersion=\d+.\d+.(?<versionD3>\d+)" | rex "DisplayVersion=\d+.\d+.\d+.(?<versionD4>\d+)" | sort host -versionD1 -versionD2 -versionD3 -versionD4 | streamstats count by host | where count=1 | eval Version = versionD1.".".versionD2.".".versionD3.".".versionD4 | dedup host, DisplayName, DisplayVersion | dedup host, DisplayName, DisplayVersion | stats estdc(host) as HostsWithPackage by DisplayName DisplayVersion</query> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> <panel> <table> <title>Hosts_missing_packages</title> <search> <query>| makeresults | eval Hosts_missing_packages=$tokhost$-$tokpack$ |table Hosts_missing_packages</query> <earliest>@d</earliest> <latest>now</latest> </search> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> </panel> </row> </dashboard> Can someone suggest how do I pass the list values from both the searches to my final panel and find the missing list of servers.

psmp · ‎07-13-2018

Moderator Note: the below was originally posted as an Answer on an old question, but being it's own question it has been split out accordingly index=testindex sourcetype=hostSoftware source="testindex://hostSoftware" host=prod1* DisplayName="anysoftware*" host=prod1* | dedup host, DisplayName | stats count(host) as #_of_Hosts_with_package by DisplayName, DisplayVersion | append [search index=testindex sourcetype=host source="testindex://hostSoftware" host=prod1*| table host | search NOT [search iindex=testindex sourcetype=hostSoftware source="testindex://hostSoftware" host=prod1* | search "DisplayName"="anysoftware*" | dedup host | table host] | rename host as Hosts_Missing_software | stats count(Hosts_Missing_software) as #_Hosts_Missing_LeostreamAgent, list(Hosts_Missing_software) as Hosts_Missing_software] The append do not yeild all of the results due to maxout limit. So moving to multisearch. I am trying to do same search with multisearch but not working. Any help is much appreciated. TIA | multisearch [search index=testindex sourcetype=hostSoftware source="testindex://hostSoftware" host=prod1* | fields hos t| rename host as Hosts_raw_List | eval type="search1" ][index=testindex sourcetype=hostSoftware source="testindex://hostSoftware" host=prod1* Name="Anysoftware*" | fields host Name Version | rename host as hostwithpack | eval type="search2" ] | eval result=search1-search2. my search1 results 12 hosts. (total number of hosts available) search 2 results 11 hosts (Hosts with software installed) I am looking for results like in table: "Name" | Version | #ofhosts withsoftware | #of hosts without software | list of hosts with no software" can anyone pls help! TIA

Posts	15
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎07-13-2018

Online Status	Offline
Date Last Visited	‎12-10-2021 04:31 PM

feed query results to raw data in makeresults

Calculate the session duration by the same field's...

How to set a standard set for span values

Drilldown for Row not using the field in search if...

Use same query for all the panels with different s...

Help combining results from different searches, ap...

Re: Calculate the session duration by the same fie...

Re: Calculate the session duration by the same fie...

Re: feed query results to raw data in makeresults

feed query results to raw data in makeresults

Re: Calculate the session duration by the same fie...

Re: Calculate the session duration by the same fie...

Re: Calculate the session duration by the same fie...

Re: Calculate the session duration by the same fie...

Calculate the session duration by the same field's...

Re: How to set a standard set for span values

How to set a standard set for span values

Re: Use same query for all the panels with differe...

Drilldown for Row not using the field in search if...

Use same query for all the panels with different s...

Help combining results from different searches, ap...