I have an eventstats search that is working well. What I am having a difficult time with is that I am unable to return results by day. The field apiid is a common id that ties together multiple events. I need the answer field fromm the smallest apiid in the group and the cr_date from the highest apiid. Here is what I have so far: base search | eventstats max(id) as maxid min(id) as minid by apiid | eval mintime=if(id=minid,answer,null()) | eval maxtime=if(id=maxid,cr_date,null()) | stats values(mintime) as mintime values(maxtime) as maxtime by apiid | convert mktime(*time) timeformat="%Y-%m-%d %H:%M:%S" | eval diff=abs(mintime-maxtime) | stats avg(diff) as AvgTime | fieldformat AvgTime=tostring(AvgTime, "duration") | eval AvgTime = round(AvgTime,2) I have tried different combinations of bucket and timechart but have been unsuccessful. Thanks in advance! ... View more

Log snippet: 0416 12:45:59.50: classify_origination(newcall) 0416 12:45:59.50: colp: 1419371523 0416 12:45:59.50: process_trunk_parm: use_trunk_fields=false 0416 12:45:59.50: ++++ SBCCTL STATS DUMP START (interval = 60) +++ 0416 12:45:59.50: STATE: ONLINE 0416 12:45:59.50: uas: rcvd=13271(2.2e+02 mps) sent=16593(2.8e+02 mps) 0416 12:45:59.50: uac: rcvd=15253(2.5e+02 mps) sent=11931(2e+02 mps) 0416 12:45:59.50: mpxy: rcvd=28322(4.7e+02 mps) sent=13869(2.3e+02 mps) 0416 12:45:59.50: other: rcvd=93899(1.6e+03 mps) sent=93899(1.6e+03 mps) 0416 12:45:59.50: spool: rcvd=6209(1e+02 mps) sent=6209(1e+02 mps) 0416 12:45:59.50: MESSAGES: rcvd=156954(2615.9 mps) sent=142501(2375 mps) 0416 12:45:59.50: Offered load: total=56846, uac=15253, uas=13271, mpxy=28322 0416 12:45:59.50: OVERFLOWS: uas=0 uac=0 mpxy=0 sbcspool=0 admctl=0 0416 12:45:59.50: QUEUES: mux:0:0:70, uas:0:0:0, uac:0:0:0, mpxy:0:0:69, sbcspool:0:0:0, admctl:0:0:3 0416 12:45:59.50: MSGS UAC/UAS: 6181:5215:129:82:3320:0:1354:1351:5508:5228 0416 12:45:59.50: MSGS MPXY: 4941:0:4949:14453:0:0 0416 12:45:59.50: MSGS SPOOL: 6209:6209 0416 12:45:59.50: CSPS (last 60 seconds): 103.02 0416 12:45:59.50: Call counts: active:2690 (init:43, trying:865, stable:1781, ending:1, teoc:0) 0416 12:45:59.50: Tunnel count: 2531 0416 12:45:59.50: sbcsipuas.1@b12sb01: CONNECTED ONLINE 2408/9000 0416 12:45:59.50: sbcsipuas.2@b12sb01: CONNECTED ONLINE 282/9000 0416 12:45:59.50: brawt.1@b12sb01: CLOSED UNKNOWN 0/9000 0416 12:45:59.50: sbch323uas.1@b12sb01: CONNECTED ONLINE 0/9000 0416 12:45:59.50: sbcsipuac.1@b12sb01: CONNECTED ONLINE 2544/9000 0416 12:45:59.50: sbcsipuac.2@b12sb01: CONNECTED ONLINE 96/9000 0416 12:45:59.50: sbcsipuac.3@b12sb01: CONNECTED ONLINE 0/9000 0416 12:45:59.50: sbcsipuac.4@b12sb01: CONNECTED ONLINE 0/9000 0416 12:45:59.50: sbcsipuac.5@b12sb01: CONNECTED ONLINE 0/9000 0416 12:45:59.50: sbcsipuac.6@b12sb01: CONNECTED ONLINE 0/9000 0416 12:45:59.50: sbcsipuac.7@b12sb01: CONNECTED ONLINE 0/9000 0416 12:45:59.50: sbcsipuac.8@b12sb01: CONNECTED ONLINE 0/9000 0416 12:45:59.50: sbch323uac.1@b12sb01: CONNECTED ONLINE 0/9000 0416 12:45:59.50: mpxy.1@b12sb01: CONNECTED ONLINE 332/1300 0416 12:45:59.50: mpxy.2@b12sb01: CONNECTED ONLINE 306/1300 0416 12:45:59.50: mpxy.3@b12sb01: CONNECTED ONLINE 289/1300 0416 12:45:59.50: mpxy.4@b12sb01: CONNECTED ONLINE 313/1300 0416 12:45:59.50: mpxy.5@b12sb01: CONNECTED ONLINE 329/1300 0416 12:45:59.50: mpxy.6@b12sb01: CONNECTED ONLINE 324/1300 0416 12:45:59.50: mpxy.7@b12sb01: CONNECTED ONLINE 327/1300 0416 12:45:59.50: mpxy.8@b12sb01: CONNECTED ONLINE 311/1300 0416 12:45:59.50: MPXY Tunnel: timeouts:0, orphans:2, min(ms):0 max(ms):23 count:4939 avg(ms):0.72262 HISTO:4939:0:0:0:0:0:0:0:0:0:0 0416 12:45:59.50: MPXY Packets (Ingress): total:5695213, toss:1988(0.034907%), out_of_seq:104(0.0018261%), lost:941(0.01652%) 0416 12:45:59.50: MPXY Packets (Egress): total:7041461, toss:220(0.0031244%), out_of_seq:74(0.0010509%), lost:3832(0.054391%) 0416 12:45:59.50: Memory Size: 1,205,137,408 0416 12:45:59.50: ++++ SBCCTL STATS DUMP END +++ 0416 12:45:59.50: classify_origination(call) 0416 12:45:59.50: colp: 0416 12:45:59.50: memory: 0416 12:45:59.50: process_trunk_parm: use_trunk_fields=true I am trying to extract all of the text between 0416 12:45:59.50: ++++ SBCCTL STATS DUMP START (interval = 60) +++ and 0416 12:45:59.50: ++++ SBCCTL STATS DUMP END +++ and include those lines and all the lines in between into a single event. This is what I have tried with no luck inputs: [monitor:///opt/splunk/testdata/*.log] sourcetype=test index = app disabled = false props: [test] TIME_PREFIX = ^ TIME_FORMAT = %m-%d %H:%M:%S.%2N MAX_TIMESTAMP_LOOKAHEAD = 32 TRUNCATE = 99999 SHOULD_LINEMERGE = true TRANSFORMS-set = setnull, setnonull Transforms: [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [setnonull] REGEX = ^.*START.*(?ms).*\+{3} DEST_KEY = queue FORMAT = indexQueue Testing the regex via an online tester selects the lines I am looking to extract. I am not sure of the issue. Any assistance would be greatly appeciated. Tks ... View more

I have 2 good searches. One outputs: Date Agent Answered Calls Average Talk Time Longest Talk Time Total Talk Time By agent/client_name The second has outbound minutes (OBMINS1) by client name. What I would like to do is add a column OBMINS1 to the 1st table and add this result to Total Talk Time. I tried using appendcols but can't seem the values to line up by client_name. Here are the 2 queries that work: base search | addinfo | convert timeformat="%A, %m/%d/%Y" ctime(_time) AS Date | dedup callid sortby disposion | stats count(_raw) as Total, count(eval(disposion="ANSWERED")) as Answered, count(eval(disposion="NO ANSWER" OR disposion="BUSY" OR disposion="FAILED" OR disposion="NOT ALLOWED")) as "Abandoned Calls", count(eval(application="Voicemail")) as "Voicemail Calls" sum(Dur) AS Seconds, max(Dur) as Longest by Date, client_name | eval ASR=round(Answered/Total*100,2)."%" | eval Minutes=round(Seconds/60,0) | eval OBMINS=round(OBSeconds/60,0) | eval ALOC=round(Minutes/Answered,2) | eval TotDur=tostring(Seconds, "duration") | eval "Longest Talk Time"=tostring(Longest, "duration") | rename client_name as Agent, TotDur as "Total Talk Time", ALOC as "Average Talk Time", Total as "Total Calls", Answered as "Answered Calls" | table Date, Agent, "Answered Calls", "Average Talk Time", "Longest Talk Time", "Total Talk Time" | addcoltotals "Answered Calls", labelfield=Date label=Totals 2nd search base search | stats count(_raw) as TotalOB, count(eval(disposion="ANSWERED")) as OBAnswered, count(eval(disposion="NO ANSWER" OR disposion="BUSY" OR disposion="FAILED" OR disposion="NOT ALLOWED")) as "OBAbandoned Calls", sum(Dur) AS OBSeconds by client_name | eval OBMINS1=tostring(OBSeconds, "duration") Thanks in advance ... View more

I would like to extract the time, did, and callerid from the event with the min(id) by apiid Additionally, extract extension_number from max(id) by apiid sample data: _time id apiid did callerid extension_number 2019-03-02 09:42:05 533481479 vejf7t2gehtq3cttuml4 18008112345 10118997050 11111103003 2019-03-02 09:42:05 533481480 vejf7t2gehtq3cttuml4 18008112345 10118997050 11111103003 2019-03-02 09:42:05 533481481 vejf7t2gehtq3cttuml4 18008112345 10118997050 11111102000 2019-03-02 09:59:34 533489343 a54pdykd7ytwjbmmo7yi 18008112345 10008556468 11111103003 2019-03-02 09:59:34 533489344 a54pdykd7ytwjbmmo7yi 18008112345 10008556468 11111102000 2019-03-02 09:59:34 533489345 a54pdykd7ytwjbmmo7yi 18008112345 10008556468 11111103003 2019-03-02 09:59:54 533489611 a54pdykd7ytwjbmmo7yi 18008112345 10008556468 11111103003 2019-03-02 09:59:54 533489612 a54pdykd7ytwjbmmo7yi 18008112345 10008556468 11111103003 2019-03-02 09:59:54 533489613 a54pdykd7ytwjbmmo7yi 18008112345 10008556468 11111100063 2019-03-02 09:59:55 533489614 a54pdykd7ytwjbmmo7yi 18008112345 10008556468 11111100063 2019-03-02 10:00:23 533489836 4tvdwnrwenhw73k4ivbu 18008112345 18086965170 11111103003 2019-03-02 10:00:23 533489837 4tvdwnrwenhw73k4ivbu 18008112345 18086965170 11111102000 2019-03-02 10:00:23 533489838 4tvdwnrwenhw73k4ivbu 18008112345 18086965170 11111103003 2019-03-02 10:00:43 533489949 4tvdwnrwenhw73k4ivbu 18008112345 18086965170 11111103003 2019-03-02 10:00:43 533489950 4tvdwnrwenhw73k4ivbu 18008112345 18086965170 11111103003 2019-03-02 10:00:43 533489951 4tvdwnrwenhw73k4ivbu 18008112345 18086965170 11111100063 2019-03-02 10:00:43 533489952 4tvdwnrwenhw73k4ivbu 18008112345 18086965170 11111100063 I have been able to extract min and max by apiid with base search | stats max(id) as maxid min(id) as minid by apiid and also tried this so those values would not dispaly base search | eventstats max(id) as maxid min(id) as minid by apiid I have been able to get the min(id) values but not sure how to combine those with max(id) fields I am looking for base search| eventstats max(id) as maxid min(id) as minid by apiid | where id=minid | table _time,did, callerid ... View more

Here is some data id apiid answer cr_date 493442120 fbnagf42wxpfmmrgrf5b 2019-01-23 19:15:41 2019-01-23 19:15:51 493442118 fbnagf42wxpfmmrgrf5b 2019-01-23 19:15:41 2019-01-23 19:15:51 493441485 fbnagf42wxpfmmrgrf5b 2019-01-23 19:15:18 2019-01-23 19:15:38 493441472 fbnagf42wxpfmmrgrf5b 2019-01-23 19:15:17 2019-01-23 19:15:38 493441471 fbnagf42wxpfmmrgrf5b 2019-01-23 19:15:17 2019-01-23 19:15:38 493440588 fbnagf42wxpfmmrgrf5b 2019-01-23 19:15:17 2019-01-23 19:15:17 493440012 5o3q2siu6lirzfbmprdp 2019-01-23 19:14:49 2019-01-23 19:15:08 493440010 5o3q2siu6lirzfbmprdp 2019-01-23 19:14:49 2019-01-23 19:15:08 493438858 5o3q2siu6lirzfbmprdp 2019-01-23 19:14:42 2019-01-23 19:14:43 493439140 kgjtl44jzdn5wtifg3pi 2019-01-23 19:14:41 2019-01-23 19:14:49 493439137 kgjtl44jzdn5wtifg3pi 2019-01-23 19:14:41 2019-01-23 19:14:49 493439114 kgjtl44jzdn5wtifg3pi 2019-01-23 19:14:41 2019-01-23 19:14:49 493439109 kgjtl44jzdn5wtifg3pi 2019-01-23 19:14:41 2019-01-23 19:14:49 493438775 kgjtl44jzdn5wtifg3pi 2019-01-23 19:14:41 2019-01-23 19:14:41 What I am trying to do is: get the answer time from min(id), the cr_date from max(id) by apiid . Get the difference between each of those by apiid, and display the avg time of all apiid's. I hope the question makes sense. I have tried a bunch of things, with no success. Any help would be greatly appreciated. Tks. ... View more