Hi, @rogerpringle. If it's been more than three years and your certificates are expired there might not be a way to access them. However, it's worth a shot to send an email to certification@splunk.com and see if there is anything they can do! Hope this helps.  ... View more

Yes I understand codes are not required for the exams. Internally in my org, I have to provide the Exam code to register for sponsored training. Thank you! ... View more

Hi sureshmurgan, thank you, I'm glad I could help. Your added complexity can easily be solved with the lookup based logic that I suggested: For the different requirements per PC, define a lookup that defines different classes of PCs: appmap.csv ClassName,AppName,AppStatus OfficeStd,Word,Required OfficeStd,Excel,Optional OfficeFin,Word,Required OfficeFin,Excel,Required Create yet another lookup for the mapping between PC classes and PCs: classmap.csv PC,ClassName X, OfficeStd Y,OfficeFin A search to check if a PC has all required applications installed would be someting like this: ... search to get an event for every InstalledAppName installed on PC ... | transaction PC | lookup classmap.csv PC output ClassName | eval AppStatus="Required" | lookup appmap.csv ClassName,AppStatus output AppName | eval AppsMissing=if(InstalledAppName!=AppName,"Apps Missing","Apps Compliant") ... ... View more

The only way I can think of to pull this off is to use streamstats to merge to events (since you said they are consecutive) then stats to remove duplicate events. I noticed the example you provided was in time ascending order, but this was built assuming the results are in time descending order: ADSite_Membership="Initiating task ContentDownload for CI*" OR ADSite_Membership="Initiating Content Download*" OR ADSite_Membership="Unable to get locations*" | table _time ADSite_Membership | streamstats current=f window=1 last(ADSite_Membership) as prev_ADSite_Membership `comment("Use the ADSite_Membership field from the previous event")` | eval status=case(like(prev_ADSite_Membership, "%Unable to get locations%"),prev_ADSite_Membership,1==1,null) `comment("Identify the status events and set the status field")` | rex field=ADSite_Membership "Initiating task ContentDownload for CI (?<Deployment>ScopeId_.*?) for target" `comment("Extract the Deployment field")` | search Deployment=* `comment("Drop the source status events which will not have a Deployment field defined")` | fields - prev_ADSite_Membership `comment("Drop prev_ADSite_Membership from the fields list")` ... View more

I actually tested it and it worked for me on 7.2.something. ... View more

@sureshmurgan would it be possible for you to add a screenshot of what you have and explain with the same as to what you need? ... View more