Worked for me. Thanks @javiergn  ... View more

Yes I understand codes are not required for the exams. Internally in my org, I have to provide the Exam code to register for sponsored training. Thank you! ... View more

Yes I understand codes are not required for the exams. Internally in my org, I have to provide the Exam code to register for sponsored training. Thank you! ... View more

I have registered in Pearson vue for certification, awaiting their email. Will see if I can find the exam codes. I need communicate to my team to take the certification exams and I need complete information with the exam codes. Once I get to the see the codes I will mark it as solution. Thanks! ... View more

Your suggestion have worked and I have marked it as the answer. I will post the addon queries in a separate thread. Thanks again Oliver! ... View more

This gives me the intended result. Thanks VatsalJagani for your help with this. ... View more

index=windowsevents sourcetype="System" SourceName=WindowsUpdate EventCode=19 OR EventCode=20 |rex field=Message "(?P<Status>Installation\s\w+):.*(?P<Update>KB\d+).*" |stats latest(_time) as Time latest(Status) as Status latest(Message) as Message by host Update |search Status="Installation Failure" ... View more

This worked well, thanks for that Oliver. Actually my requirement is a lot more complex. I will try to explain it here, This is the query am using now, | pivot Application_ApplicationInventory latest(InstallDate) as InstallDate latest(DisplayVersion) as DisplayVersion splitrow host splitrow DisplayName filter host in (101,102,103,104) filter DisplayName in ("Adobe","Chrome","vlc") | where isnotnull(DisplayName) | eval PreReq=case((DisplayName="Adobe" AND DisplayVersion < "7.5") OR (DisplayName="Chrome" AND DisplayVersion < "2.0") OR (DisplayName="vlc" AND DisplayVersion < "6.0"),"1",true(),"0") This is giving me the result as intended for the PCs where its installed. I have some more requirements and need to include those conditions as well, 1. Need to mark the PCs as non compliant where any of these applications is not installed at all. It would be nice if we know what application is not installed but not mandatory at this point.(This data is not available directly. I have an option to append the PCs separately but search goes longer.) 2. Compliance for another app AdobeAcrobat (this will not be present in all PCs but we need to consider only the PCs where its installed and check for the version to mark it as compliant or noncompliant) 3. Compliance for two apps IE and Mozilla (either IE or Mozilla will be present in the PCs, so if any of them is present - check for the respective version and mark as compliant or noncompliant. Also, here when both these apps are not installed we have to mark it as noncompliant) Like I have said before we have to check for all these and mark a PC as compliant or noncompliant. I have tried to explain as clearly as I could. Any suggestion is greatly appreciated. ... View more

This looks like a nice logic. Will attempt this and get back. Thank you 🙂 ... View more

Here's little more information about the query and the result and what I want. Search : ADSite_Membership="Initiating task ContentDownload for CI*" OR ADSite_Membership="Initiating Content Download*" OR ADSite_Membership="Unable to get locations*" |table _time ADSite_Membership Search Result: 2019-06-19 12:36:15.000 Initiating task ContentDownload for CI ScopeId_B4419992-1C14-4FC6-AB4E-D7730CD14853/DeploymentType_4a3a8593-e333-4bb4-a3f9-bb1ce19cf0eb.6 (GP4.1.11 BlueCoatDecom - User Interactive) for target: , consumer: {CA8EDD4A-6D29-4CE0-90AD-0EB22011B165} 2019-06-19 12:36:15.000 Initiating task ContentDownload for CI ScopeId_B4419992-1C14-4FC6-AB4E-D7730CD14853/DeploymentType_28ce7e7a-307a-417b-baf1-70c6bf0889d9.10 (Intel GFX driver 6th 7th 8th Apollo Gemini (EUDM - ALL)) for target: , consumer: {FE0C1DDA-725A-4FF2-9E20-D78968FAC529} 2019-06-20 12:58:02.414 Unable to get locations, no need to continue with download 2019-06-20 13:07:52.000 Initiating task ContentDownload for CI ScopeId_B4419992-1C14-4FC6-AB4E-D7730CD14853/DeploymentType_28ce7e7a-307a-417b-baf1-70c6bf0889d9.10 (Intel GFX driver 6th 7th 8th Apollo Gemini (EUDM - ALL)) for target: , consumer: {546E275F-FE56-4EA8-A37B-41508E57148D} Requirement : If you look at the 3rd row, it has "Unable to get locations*". When we get it in results I want to extract that as Status and also I want to extract the value from previous event "ScopeId*" as Deployment ... View more

Hi Giuseppe, Status is not showing any value at all. I have given explained it further with a sample. Please have a look and let me know if you need more information. Thanks for your help with this! I am searching events with the following values in the field ADSite_Membership, ADSite_Membership="Initiating task ContentDownload for CI*" OR ADSite_Membership="Initiating Content Download*" OR ADSite_Membership="Unable to get locations*" If I pull the events as is, I get the below results, 2019-06-19 12:36:15.000 UK922061 Initiating task ContentDownload for CI ScopeId_B4419992-1C14-4FC6-AB4E-D7730CD14853/DeploymentType_4a3a8593-e333-4bb4-a3f9-bb1ce19cf0eb.6 (GP4.1.11 BlueCoatDecom - User Interactive) for target: , consumer: {CA8EDD4A-6D29-4CE0-90AD-0EB22011B165} 2019-06-19 12:36:15.000 UK922061 Initiating task ContentDownload for CI ScopeId_B4419992-1C14-4FC6-AB4E-D7730CD14853/DeploymentType_28ce7e7a-307a-417b-baf1-70c6bf0889d9.10 (Intel GFX driver 6th 7th 8th Apollo Gemini (EUDM - ALL)) for target: , consumer: {FE0C1DDA-725A-4FF2-9E20-D78968FAC529} 2019-06-20 12:58:02.414 UK922061 Unable to get locations, no need to continue with download 2019-06-20 13:07:52.000 UK922061 Initiating task ContentDownload for CI ScopeId_B4419992-1C14-4FC6-AB4E-D7730CD14853/DeploymentType_28ce7e7a-307a-417b-baf1-70c6bf0889d9.10 (Intel GFX driver 6th 7th 8th Apollo Gemini (EUDM - ALL)) for target: , consumer: {546E275F-FE56-4EA8-A37B-41508E57148D} Requirement : If you look at the third row result, I have "Unable to get locations*" . When we find this result, I want to extract it as Status and want to extract the ScopeId_* from the previous event as Deployment. ... View more

Hi Giuseppe, I get to see Deployment field now but Status is still blank. I have tried both rex commands you had shared. Please note there could be many events in the field and we need to stop extracting only the two consecutive lines and should not go beyond that. ... View more

I got the solution. I am using windows events to keep a track of the installation failure and got a query working for it. Thanks! ... View more

Here's the query that's written till now. This will fetch all the Installation success and failure events and going to give the latest result. There could be multiple updates and some might have failed and other updates that came through would have got installed fine. So, this query is only going to give me the latest log where its failure. I need to get all the installation failure logs with the respective updates. Not sure if this is this clear enough? index=sccm_uk source="C:\Windows\CCM\Logs\WUAHandler.log" sourcetype=WindowsCCMLogs host="*" (ADSite_Membership="Installation job encountered some failures") OR (ADSite_Membership="Installation of updates completed.") |stats latest(ADSite_Membership) as WUAInstallError by host |search WUAInstallError!="Installation of updates completed." |dedup host |stats dc(host) as #Hosts by WUAInstallError |sort 0 - #Hosts |addcoltotals #Hosts ... View more

Hi Vatsal, thanks for responding. Here's the query that's written till now. This will fetch all the Installation success and failure events and going to give the latest result. There could be multiple updates and some might have failed and other updates that came through would have got installed fine. So, this query is only going to give me the latest log where its failure. I need to get all the installation failure logs with the respective updates. Not sure if this is this clear enough? index=sccm_uk source="C:\Windows\CCM\Logs\WUAHandler.log" sourcetype=WindowsCCMLogs host="" (ADSite_Membership="Installation job encountered some failures") OR (ADSite_Membership="Installation of updates completed.") |stats latest(ADSite_Membership) as WUAInstallError by host |search WUAInstallError!="Installation of updates completed." |dedup host |stats dc(host) as #Hosts by WUAInstallError |sort 0 - #Hosts |addcoltotals #Hosts ... View more

This didn't work on my first attempt, will try this as well. Thanks Wood! ... View more

This worked right when I added it to my base query. Search result of the base query had an additional backslash but it fits the purpose. Thanks koshyk! ... View more

Here's the entire source code for better understanding. Here drilldown is not returning any result because base search result has one backslash to it. We need to somehow change the resulting value in the base search which is the input for drill down, to replace \ to \ and it should happen automatically when we click on the resulting base search row value where it only has single backslash, ( WMIError="Unable to connect to root\cimv2"). Need some modification in the drill down search. Time <earliest>-24h@h</earliest> <latest>now</latest> <search> <query>index=sccm_uk source="C:\\Windows\\CCM\\Logs\\execmgr.log" sourcetype=WindowsCCMLogs host="*" WMIError="Unable to connect to root\\cimv2*" |dedup host |stats count(host) as #Hosts by WMIError |sort 0 - #Hosts |addcoltotals #Hosts</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <drilldown> <set token="WMI">$row.WMIError$</set> </drilldown> <search> <query>index=sccm_uk source="C:\\Windows\\CCM\\Logs\\execmgr.log" sourcetype=WindowsCCMLogs host="*" WMIError="$WMI$" |convert ctime(_time) as Time timeformat="%d-%m-%Y %H:%M:%S" |stats latest(WMIError) as WMIError values(Time) as Time BY host</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> ... View more

Here's the entire source code for better understanding. Here drilldown is not returning any result because base search result has one backslash to it. We need to somehow change the resulting value in the base search which is the input for drill down, to replace \ to \ and it should happen automatically when we click on the resulting base search row value where it only has single backslash, For eg : WMIError="Unable to connect to root\cimv2" WMi Test <input type="time" token="field1"> <label>Time</label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> <panel> <table> <search> <query>index=sccm_uk source="C:\\Windows\\CCM\\Logs\\execmgr.log" sourcetype=WindowsCCMLogs host="*" WMIError="Unable to connect to root\\cimv2*" |dedup host |stats count(host) as #Hosts by WMIError |sort 0 - #Hosts |addcoltotals #Hosts</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">cell</option> <option name="percentagesRow">false</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> <drilldown> <set token="WMI">$row.WMIError$</set> </drilldown> </table> </panel> <panel depends="$WMI$"> <title>Host details for $WMI$</title> <table> <search> <query>index=sccm_uk source="C:\\Windows\\CCM\\Logs\\execmgr.log" sourcetype=WindowsCCMLogs host="*" WMIError="$WMI$" |convert ctime(_time) as Time timeformat="%d-%m-%Y %H:%M:%S" |stats latest(WMIError) as WMIError values(Time) as Time BY host</query> <earliest>$field1.earliest$</earliest> <latest>$field1.latest$</latest> </search> </table> </panel> ... View more