I have data that looks like this. 2018-12-13 18:48:05.411 +0000 Tag="Door_Locked" Value="1" 2018-12-13 19:42:41.885 +0000 Tag="AirTC02" Value="1110" 2018-12-13 19:42:41.010 +0000 Tag="VacXdcr2" Value="1663" 2018-12-13 20:48:05.411 +0000 Tag="Door_Locked" Value="0" 2018-12-14 19:42:41.885 +0000 Tag="AirTC02" Value="1220" 2018-12-14 19:42:41.010 +0000 Tag="VacXdcr2" Value="1964" 2018-12-14 20:48:05.411 +0000 Tag="Door_Locked" Value="1" 2018-12-15 19:42:41.885 +0000 Tag="AirTC02" Value="1220" 2018-12-15 19:42:41.010 +0000 Tag="VacXdcr2" Value="1963" 2018-12-15 20:48:05.411 +0000 Tag="Door_Locked" Value="0" What I want. I would like to have a table with Time for the event. And have the unique tag and value and then a value for whether or not the most recent value for Door_Locked was a 1 or a 0. Stretch goal. I'd like to identify anytime the Door_Locked Value is a 1 with a counting ‘Session_Num”. Session_Num if possible should increment and be available only if the door_locked is equal to 1. I know I can always throw these away with another search for any non 1 (true) door_)locked event. Make sense? I do already have the tagged events parsed out so I can do something in my searches already for Door_Locked=1 Door_Locked=0. What is the best way to accomplish this. I have tried with streamstats but am not getting the Door_Locked state to stick as a field for every event. Is temporal lookups another option? Thank you for your help. A Table something like ... View more

Stumped here. I have a logfile that looks like 18:21:05 (lmgrd) TIMESTAMP 8/16/2017 18:26:06 (ansyslmd) TIMESTAMP 8/16/2017 18:05:35 (ansyslmd) OUT: "hfss_solve" rv@rv.com 18:05:50 (ansyslmd) IN: "hfss_solve" rv@rv.com 18:20:32 (ansyslmd) OUT: "hfss_solve" rv@rv.com 18:20:32 (ansyslmd) IN: "hfss_solve" rv@rv.com 18:21:05 (lmgrd) TIMESTAMP 8/17/2017 18:26:06 (ansyslmd) TIMESTAMP 8/17/2017 19:28:24 (ansyslmd) OUT: "hfss_solve" rv@rv.com 19:28:37 (ansyslmd) IN: "hfss_solve" rv@rv.com 19:36:27 (ansyslmd) OUT: "hfss_solve" rv@rv.com 19:36:39 (ansyslmd) IN: "hfss_solve" rv@rv.com The time part is correct on the left. And whenever a 'TIMESTAMP' line shows up id like to make that the correct 'date' portion of the timestamp used for the event in Splunk. Can somebody tell me how to get this done. Im expecting ill need to setup a new sourcetype in Splunk for it. Can someone give me an outline of how to get this done here? Thank you. ... View more

I have a dashboard and set of queries where i want to give someone the ability to select the time range. A time range isnt really as important as giving me the selection for latest time. Since I am building queries based on that. Specifically in the example below I want to only show the data for the day previous to the latest time selected in other words I want to make the time selection earliest=now-48hours(snap to day) latest=now-24hours(snap to day) Here is the query I am trying to use but it isnt working as written. The time token name is TimeRange <query>host=host123 index=security123 sourcetype="SplunkLog123" earliest=$TimeRange.latest$-2d@d latest=$TimeRange.latest$-1d@d</query> Thanks for your help in advance. ... View more

I have an inputlookup file that shows temperature records and is formatted as follows rec-date,average-low,average-high,record-low,record-high,average-precip,average-snow 1-Jan,16,45,-18 (1974),69 (1997),"0.02""",NA 2-Jan,16,45,-12 (1974),67 (1997),"0.02""",NA 3-Jan,16,44,-18 (1974),76 (1997),"0.02""",NA 4-Jan,15,44,-22 (1974),68 (1956),"0.02""",NA 5-Jan,15,44,-15 (1971),70 (2001),"0.02""",NA 6-Jan,15,44,-20 (1974),70 (2001),"0.02""",NA 7-Jan,15,44,-11 (1970),61 (1990),"0.02""",NA 8-Jan,15,44,-12 (1970),67 (1956),"0.02""",NA 9-Jan,15,44,-20 (1962),72 (2003),"0.02""",NA 10-Jan,15,45,-29 (1962),65 (1990),"0.02""",NA 11-Jan,15,45,-22 (1963),72 (1990),"0.02""",NA 12-Jan,15,45,-32 (1963),70 (1953),"0.02""",NA 13-Jan,16,45,-18 (1963),68 (1996),"0.02""",NA 14-Jan,16,45,-10 (1972),73 (1996),"0.02""",NA 15-Jan,16,45,-9 (1972),64 (1996),"0.02""",NA 16-Jan,16,45,-10 (1992),68 (1996),"0.02""",NA 17-Jan,16,45,-9 (1962),65 (1965),"0.02""",NA 18-Jan,16,45,-21 (1984),66 (1985),"0.02""",NA 19-Jan,16,45,-18 (1963),69 (1985),"0.01""",NA 20-Jan,16,45,-17 (1962),70 (1986),"0.01""",NA 21-Jan,16,45,-16 (1959),70 (1986),"0.01""",NA 22-Jan,16,45,-12 (1962),64 (1969),"0.01""",NA 23-Jan,16,45,-16 (1963),66 (1981),"0.01""",NA 24-Jan,16,45,-8 (1963),69 (1981),"0.01""",NA 25-Jan,16,46,-1 (1957),68 (1981),"0.01""",NA 26-Jan,17,46,-10 (1996),64 (1953),"0.01""",NA 27-Jan,17,46,-13 (1963),72 (1975),"0.01""",NA 28-Jan,17,46,-7 (1980),69 (2003),"0.01""",NA 29-Jan,17,46,-5 (1957),65 (1987),"0.01""",NA 30-Jan,17,46,-4 (1994),65 (1976),"0.01""",NA 31-Jan,17,46,-9 (1994),69 (1954),"0.01""",NA I would like to extract the records for just the current date and am trying something like this |inputlookup Historic-80014-temps.csv | eval todaysDateString=strftime(now()," %e-%b") | where rec-date==todaysDateString This returns nothing and I have verified that todaysDateString is coming in the same format as the rec-date below. Can someone help me build a search that will work for this? BONUS points: I am also trying to pull the records for just the current month also. Attached is a screenshot of how the data is looking inside of Splunk. Thank you. ... View more

Need help parsing file Each file represents a unique complete test. Here is a snippet of what we have. Some notes: It breaks on the word BREAKERWORD Can have multiple type of events First part with SYSTEM_PARM is just a key value pair that we need to parse Second and third parts (in-between BREAKERWORD). Name is the Name of the test. DATA represent parts of the test. ANd then the BEGIN and END sections map to the 'parts of the test' in the order that they are presented. In other words looking at refFirstItem maps to the 1st BEGIN and END section with these two values --> -7.107569270486e+01 and -8.107569270486e+01. If you have an actual solution to this problem a massive thanks. But even if you have suggestions on how to attack this or if it is reasonably possible to complete with Splunk please pipe and and give a hand. Thank you in advance BREAKERWORD NAME PARAMETERS #SYSTEM_PARM SourceQueue ABCD123 #SYSTEM_PARM SourceNode EFGHI456 #SYSTEM_PARM DestinationQueue JKL789 #SYSTEM_PARM DestinationNode MNO012 BREAKERWORD NAME ABCD DATA refFirstItem DATA refSecondItem DATA refThirdItem BEGIN -7.107569270486e+01 -8.107569270486e+01 END BEGIN -2.767100000000e+01 END BEGIN -1.345589265277e+01 END BREAKERWORD NAME EFGH DATA ArefFirstItem DATA ArefSecondItem BEGIN -7.107569270486e+01 -8.107569270486e+01 END BEGIN -2.767100000000e+01 END ... View more