Hi all, I am racking my brains on this one. The business has built field names containing years and volumes in the fieldname... (don't ask why). So the field for a single user could contain 3 fields like the below (and contain either true or false for each year) fieldname multiyearfield19(3) multiyearfield18(9) multiyearfield20(87) TextString false true false What I need to be able to do is search and isolate where any of these multifields = true. Is it possible? As I am struggling... The basic multiyearfield*=true won't work. The rex I am trying to do won't work and joining the fields into a single name won't work as some fields contain true and others false. Any advice is gratefully received. ... View more

hi all . I am trying to create a map where I can look at users max duration between logins who register with us between 2 fixed dates i.e. jan17-feb17. So i have the following which is interesting but doesnt give the max length. | dedup eventId | stats count(_time) as appear_count, values(_time) as appear_dates max(_time) as last min(_time) as latest by customerNumber | eval first_appear=strftime(first,"%d/%m/%Y") | eval last_appear=strftime(last,"%d/%m/%Y") | eval appear_dates=strftime(appear_dates,"%d/%m/%Y") | eval duration=(last-latest) | eval duration=round((last-first)/86400) | where first<01/02/2019 For example i have a user that has used the service 400 times with a max break of about a week. So i needed the search to pick up the user where first appear = jan-feb2017 and then i need to know that this user has had at max a weeks break between accessing. Does this make sense. Its almost as if i need towrite the search to collect all users where first<28/02/2017. - and then i need to eval each event in order and subtract the later from the earlier,.. so for someone who accessed the service 5 times it would be USER ONE first=22/02/2017 event 1 22/02/2017 event 2 25/02/2017 (diff between event 2-1 = 3days) event 3 01/03/2017 (diff between event 3-2 = 4days) event 4 09/03/2017 (diff between event 2-1 = 8days) LAST event 5 10/03/2017 (diff between event 2-1 = 1day) Therefore max duration between events = 8days ... View more

morning all, I am struggling with the logic around doing this. I am trying to run a report from 01/01/2018 to today looking at how many times (ideally in a range), that users are using the service. (what they do is almost irrelevant, just that they are on it is enough. The challenge is 1 want 2 years of behaviour and not anyone using it within 2 years... so ideally i need to isolate all users who entered in say 01/01/2018 to 01/02/2018 and then what their behaviour has been over the 2 years since. What i have so far is: sourcetype=mymainsourcetype | stats values(_time) as source by clientIP (this is ideal as i get to see ALL the users and their entries (however i now need to isolate just where the first entry is between 1st jan 18 and 1st feb 18. any ideas would be great ... View more

Hi all, hope there is a way to do the following. I am trying to find out how many events it takes for a user to go from "start" URL to "end" URL. This is important as the start and end URLs are not the session start and end points but I need to ONLY count the events inside the start and end URLs. Start URL is "start" Finish URL is "end" Journeys events look like: enter site info pages login auths *START URL* ....lots and lots of events in and outside of source & types so the main search can't search by source/type as it would exclude important counts. END URL* continue detail exit* Urls are held in the same data field (lets say "url"), however, a user journey can go through multiple sources, multiple types, multiple different auth journeys (all keep the same sessionID) but we could be looking at 400+ events per journey and the ONLY CONTINUOUS data field is sessionID. Any ideas are greatly appreciated. ... View more

hi all, i hope you can help. i have the below search where i a csn of 4000+sessionID's and i need to find a uniquereference from each of the sessions. If i manually type in the session ID then it works fine but the lookup doesn't seem to want to work as a filter. (Session= the lookup title and X-Session-ID is the event session id in splunk i am trying to match together before grabbing the uniquereference from the audit). | lookup sessionslookup.csv Session | spath output=uniquereference1 input=detail.responseMessage path=reference1 | spath output=uniquereference2 input=detail.responseMessage path=reference2 | table Session X-Session-ID | rename Session as X-Session-ID | table X-Session-ID saUTR saUTR2 any ideas ... View more

Morning all, I hope this is an easy one where i am just missing some login somewhere. I have a field called errors that houses data that looks like this: *Fieldname * errors String 56005:16;69002:1;56009:3958 This is indicating that a single event can incur multiple errors and i need to pull all the error codes separately (codes are always numerical and always 5 digits long). The colon and digits after indicate count volumes which are irrelevant and the delimiter is always a semi-colon. This seems quite an easy pull as the rex is simply "(\d\d\d\d\d):" However i can't get splunk to spit anything out at all (and ive tried lots of variations). Ideally i want to stats value the result by user so i end up with something like the below: user1 56005 56002 69009 User2 66095 56077 any ideas?: ... View more

Thanks in advance all. I have a lookup file called ga.csv . This has a single column of Google Client ID s under a column title of clientId . In splunk, any interaction with google is recorded in an event under the element detail.gaRef (for example stats count by detail.gaRef will list all refs and event count s). In the same audit Source/Type we also record an X-Session-ID . I am looking to get the splunk X-Session-ID for all of the users in this lookup file but i can't figure out how to do it. Where I am at: - I have uploaded the csv successfully and can see the contents using | inputlookup ga.csv - I have tested the search manually by entering multiple Client ID s with OR statements between the id's and that works fine as it shows any sessionID where the client id also appears...i.e. MySearchInAuditSourcetype AND (clientId1 OR clientId2 OR clientId3) | table request.tags.X-Session-ID | outputlookup CIDSessionID.csv I have 250k client ID s so i need a csv solution to this search.... any ideas would be much appreciated. My current search MySearchInAuditSourcetype [| inputlookup "ga.csv" | table clientId | rename request.tags.X-Session-ID as search ] | dedup request.tags.X-Session-ID | table request.tags.X-Session-ID | outputlookup p800SessionID.csv any ideas? ... View more

Morning all, In short I need to be able to run a CSV lookup search against all my Splunk logs to find all SessionID' s that relate to the unique identifier in my CSV (ID1).....and then use those SessionID's to search again and find a different Unique Identifier (ID2) held in the same logs. I have no influence in the setup unfortunately... and i need to use the lookup first to isolate the right sessionID's belonging to ID1. Finding the SessionID's associated with ID1 is fine, but i can't seem to run the search against the session ID's, and table ID2. (effectively i need to table the results as we needs ID2 for further investigation. Any thoughts (excuse the poor attempt below). 1st Lookup = * [inputlookup ID1.csv] detail.detail1!="detail1" AND detail.detail2="detail2" AND detail.Body="***" | table date_mday date_month ID1 SessionID Updated search to include subsearcg (but i don't think it is pulling against the SessionID * [inputlookup ID1.csv] detail.detail1!="detail1" AND detail.detail2="detail2" AND detail.Body="***" [search * SessionID] | table date_mday date_month ID1 SessionID ... View more