I am ingesting data at 6AM, 2PM, 7PM, 10PM (CST) Is there anyway I could have my query check the time and set earliest to the time that it past last? ie: It is 8AM CST time, the search would set earliest to 6AM It is 9PM CST time, the search would set earliest to 7PM Thanks ... View more

I know this can be done with an append, but I am pretty sure this is possible just via evals. Please help me out if possible. Index=source earliest=-48h@h | bin _time span=15m | search CustomName=Place123 | eventstats avg(RawStatus_Avg) AS perHour by _time | timechart span=60m avg(perHour) as Total by CustomName | eval threshold=relative_time(now(),"-30m") | stats avg(eval(_time<threshold)) as Old avg(eval(_time>threshold)) as Current by Total | eval OldAvgCnt=Old/95 | eval ratio=Current/OldAvgCnt | table ratio I am trying to see the last 30 minutes vs. the last 48 hours both with lines on a chart. Thanks, ... View more

There are 3 fields important to this search Application InstalledVersion InstalledStatus I am trying to find devices that are missing an Application completely, (not just missing the latest version of the application) So as an example I made an app called Fact_Checker V.1, then I updated this application: Fact_Checker v.2 I want to know what devices do not have the application at all I have tried: InstalledStatus NOT Installed - No results (Because it checks ALL applications for the Installed status = Installed which is not what I need, I need it to show by application, some might be empty because they have zero devices with no installs but others will have a few missing the application completely) InstalledStatus != Installed - Shows me previous versions or new versions of the same application Search (Application=* AND InstalledStatus NOT Installed) - No results The issue is I have other applications also reporting, I need this done on a per app basis. Ie: How many do not have any version of Fact_Checker installed? How many do not have any version Browser_App installed? How many do not have any version Wifi_Settings_App installed? ... View more

I know I am for sure over-complicating this. I need to find values that are in field x, that are not in field y. This is my first query: index=nitro_prod_loc_server earliest=-4h | stats values("locId") as All_Locs This returns all locations, it requires a 4 hour timespan This is my second query: index=nitro_prod_loc_server appName="nitroCheck" bdy.addInfo{}.key="Serial Number" | stats values("locId") as "Checked_Locs" This returns a list of locations that have been checked, it needs the time to be set to all time. I want a list of locations not found in the second query. Any suggestions? ... View more

I want to find how many times an event happens based on the value of another field. Basically a count of IP addresses when they are "Connected" or "Disconnected". CA is the IP address SE is what tells me if they are connected/disconnected I feel like this should be simple, but I have tried a few things to no avail: | stats latest(SE) as SE by CA | stats distinct_count(CA) as count_CA by SE | stats dc(eval(if(SE=DISCONNECTED, count_CA, NULL))) AS disconnected_CA, dc(eval(if(SE=CONNECTED, count_CA, NULL))) AS connected_CA Provides 0 in both fields (Not true) | stats latest(SE) as SE by CA | eval disconnectedCheck = if(SE==DISCONNECTED, disconnected_SE, disconnectedCheck) | stats dc(CA) as disconnected_CA by disconnected_SE | stats values(disconnected_CA) No Results | stats latest(SE) as SE by CA | stats distinct_count(CA) as count_CA by SE | eventstats sum(count_CA) as total_CA | search SE = "DISCONNECTED" | eventstats values(count_CA) as disconnected_CA | search SE = "CONNECTED" | eventstats values(count_CA) as connected_CA, values(total_CA) as total_CA | eval Percentage=round((disconnected_CA/total_CA)*100,2) | table disconnected_CA, total_CA, connected_CA, Percentage No results Any Ideas, would prefer not to append if possible? ... View more

I have this query that works in all regex assist sites but is too greedy for my Splunk Environment. I am unable to add it to props, and it must be in the query itself. | rex "^(?:{\"publish_time\": )(?<PublishTime>[^,]+).+?(?:\"ver\\\" : \\\")(?<Ver>[^\\\]+).+?(?:\"storeId\\\" : \\\")(?<StoreNum>[^\\\]+).+?(?:\"MSRReach\\\" : \\\")(?<ScannerConnection>[^\\\]+).+?(?:\"isConnected\\\" : )(?<ConnectedStatus>[^,]+).+?(?:\"isProduction\\\" : )(?<Prod>[^,]+).+?(?:\"serialNumber\\\" : \\\")(?<ScannerSerialNum>[^\\\]+).+?(?:\"OSVersion\\\" : \\\")(?<ScannerOSVersion>[^\\\]+).+?(?:\"model\\\" : \\\")(?<ScannerModel>[^\\\]+).+?(?:\"Serial\\\" : \\\")(?<iPadSerial>[^\\\]+).+?(?:\"battery\\\" : \\\")(?<iPadBattery>[^\\\]+).+?(?:\"osVersion\\\" : \\\")(?<iPadOSVersion>[^\\\]+)$" Here is what a log looks like {"publish_time": 1548432475.596, "data": {"insertId": "xueeeeees", "receiveTimestamp": "2019-01-21T15:51:31.311111132Z", "logName": "projects/nitro-mobile/logs/boot", "labels": {"compute.awsapis.com/resource_name": "-------", "container.awsapis.com/pod_name": "-----------", "container.awsapis.com/stream": "----", "container.awsapis.com/namespace_name": "---------"}, "jsonPayload": {"thread": "http-nitro", "timestamp": "1548432475.596", "message": "payload=2019/01/01 StartEvent {\n \"appDetails\" : {\n \"version\" : \"1\",\n \"number\" : \"1\",\n \"ver\" : \"11.1.0\",\n \"release\" : \"11.1.1\",\n \"storeId\" : \"0120\",\n \"terminalId\" : \"41\"\n },\n \"capTime\" : \"2019-01-01 10:59:48\",\n \"MSR\" : {\n \"MSRReach\" : \"Scanner not connected\",\n \"version\" : \"Not available\",\n \"isConnected\" : true,\n \"SB\" : \"\"\n },\n \"isProduction\" : true,\n \"pinpad\" : {\n \"serialNumber\" : \"111-112-111-111\",\n \"OSVersion\" : \"AWS12343\",\n \"model\" : \"910X5\"\n },\n \"MDM\" : {\n \"lastSeen\" : \"Not Available\"\n },\n \"device\" : {\n \"Serial\" : \"BV12AXAJ013J\",\n \"battery\" : \"100.0\",\n \"network\" : \"ReachableViaWiFi\",\n \"osVersion\" : \"11.0.1\",\n \"memory\" : \"100\"\n }\n} EndEvent\n" Any ideas to improve efficiency? ... View more

So I tested this regex with regex101 and it seems to be working but Splunk doesn't seem to like it. Any ideas? | rex field=_raw "^(?:{\"publish_time\": )(?P<PublishTime>[^,]+)?|(?:\"ver\\\" : \\\")(?P<Ver>[^\\]+)|(?:\"storeId\\\" : \\\")(?P<StoreNum>[^\\]+)|(?:\"MSRReach\\\" : \\\")(?P<ScannerConnection>[^\\]+)|(?:\"isConnected\\\" : )(?P<ConnectedStatus>[^,]+)|(?:\"isProduction\\\" : )(?P<Prod>[^,]+)|(?:\"serialNumber\\\" : \\\")(?P<ScannerSerialNum>[^\\]+)|(?:\"OSVersion\\\" : \\\")(?P<ScannerOSVersion>[^\\]+)|(?:\"model\\\" : \\\")(?P<ScannerModel>[^\\]+)|(?:\"Serial\\\" : \\\")(?P<iPadSerial>[^\\]+)|(?:\"battery\\\" : \\\")(?P<iPadBattery>[^\\]+)|(?:\"osVersion\\\" : \\\")(?P<iPadOSVersion>[^\\]+)$" Here is what the log looks like {"publish_time": 1548432475.596, "data": {"insertId": "xueeeeees", "receiveTimestamp": "2019-01-21T15:51:31.311111132Z", "logName": "projects/nitro-mobile/logs/boot", "labels": {"compute.awsapis.com/resource_name": "-------", "container.awsapis.com/pod_name": "-----------", "container.awsapis.com/stream": "----", "container.awsapis.com/namespace_name": "---------"}, "jsonPayload": {"thread": "http-nitro", "timestamp": "1548432475.596", "message": "payload=2019/01/01 StartEvent {\n \"appDetails\" : {\n \"version\" : \"1\",\n \"number\" : \"1\",\n \"ver\" : \"11.1.0\",\n \"release\" : \"11.1.1\",\n \"storeId\" : \"0120\",\n \"terminalId\" : \"41\"\n },\n \"capTime\" : \"2019-01-01 10:59:48\",\n \"MSR\" : {\n \"MSRReach\" : \"Scanner not connected\",\n \"version\" : \"Not available\",\n \"isConnected\" : true,\n \"SB\" : \"\"\n },\n \"isProduction\" : true,\n \"pinpad\" : {\n \"serialNumber\" : \"111-112-111-111\",\n \"OSVersion\" : \"AWS12343\",\n \"model\" : \"910X5\"\n },\n \"MDM\" : {\n \"lastSeen\" : \"Not Available\"\n },\n \"device\" : {\n \"Serial\" : \"BV12AXAJ013J\",\n \"battery\" : \"100.0\",\n \"network\" : \"ReachableViaWiFi\",\n \"osVersion\" : \"11.0.1\",\n \"memory\" : \"100\"\n }\n} EndEvent\n", Thanks ... View more

I have this query | rex field=_raw "(?ms)^[^\]\n]\]\s+(?P [^:]+)(?:[^:\n] :){2}(?P [^,]+)[^:\n]:\w+=(?P [^,]+)[^;\n] ;\w+:(?P [^;]+);\w+:(?P [^;]+)(?:[^:\n]*:){2}\w+\\(?P \w+)" I was not able to capture everything I wanted ie from the first event below: (I need Severity, Type, Status, Server, DNS, IP, UN, USERID, when unavailable would be blank) Severity = INFO Type = DesktopControlJMS Status = PENDING Server = cn=c111111f-0111-4111-a111-cc01111111 DNS = gvlcsnav4025.ad.nitro.com IP = 10.111.111.111 UN = un12802 USERID = cn=s-2-2-22-59222222-343222254-204222229-4722223 I am trying to capture the data from events like this: 2019-01-11T07:41:10.400-06:00 INFO (4440-4444) <DesktopControlJMS> [Audit] PENDING:Server:cn=c111111f-0111-4111-a111-cc01111111,ou=servers,dc=vdi,dc=vm,dc=int;Pool:cn=gvlcsnav4,ou=server groups,dc=vdi,dc=vm,dc=int;DNS:gvlcsnav4025.ad.nitro.com;IP:10.111.111.111;IP6:null;USER:LP\un12802;USERDN:cn=s-2-2-22-59222222-343222254-204222229-4722223,cn=foreignsecurityprincipals,dc=vdi,dc=vm,dc=int;BROKERUSERSID:s-2-2-22-59222222-343222254-204222229-4722223; 2019-01-11T07:46:06.049-06:00 INFO (4444-1300) <DesktopControlJMS> [Audit] STARTUP:Server:cn=eeeeed6-eeeb2-eee3-beed-56eeeeeeeb77,ou=servers,dc=vdi,dc=vm,dc=int;Pool:cn=gvclsnav2,ou=server groups,dc=vdi,dc=vm,dc=int;DNS:gvclsnav2069.ad.nitro.com;IP:10.990.999.1;IP6:null; 2019-01-11T07:36:03.140-06:00 INFO (1444-0622) <MachineControler> [Audit] PENDING:Server:cn=7677778c-d777-4777-a777-587777772d,ou=servers,dc=vdi,dc=vm,dc=int;Pool:cn=gvsview01,ou=server groups,dc=vdi,dc=vm,dc=int;DNS:gvsview030276.ad.nitro.com;IP:10.122.222.221;IP6:null;USER:LP\UNVA33E;USERDN:cn=s-2-2-22-5999990-343999999-204999989-469993,cn=foreignsecurityprincipals,dc=vdi,dc=vm,dc=int;BROKERUSERSID:s-2-2-22-5999990-343999999-204999989-469993; Any suggestions or ideas would be greatly appreciated!! ... View more

I have data like this: 21,enrollmentgroup,19936,40:G6:7Q:G6:89:FG,,nitro - Circle.one10,Phone,11.1.11313,C,10/25/18 4:58,Enroll,enroll@ms.com,Movies & TV,microsoft,Public,YES,,2019.11111.10112.0,0,0,0,Installed,App installed by user,10/24/18 14:50,10/25/18 4:00 21,enrollmentgroup,19935,20:11:32:11:61:71,,nitro - Circle.one10,Phone,10.0.14393,C,10/25/18 4:58,Enroll,enroll@ms.com,PC Manager,c10f24324242432-43242,Internal,YES,11.5.1.11119,18.10.3.1009,0,0,0,Pending Install,Installed,10/24/18 14:49,10/24/18 22:09 443,S-0001,11222,01:11:7F:E1:D1:71,,nitro - loop.one12,Phone,10.0.14393,C,9/3/18 12:23,Enroll,enroll@ms.com, Mapping Better,631d-2e321-4312-b511f-83f2,Internal,YES,10.0.0.623,20.0.0.5921,0,0,0,Pending Install,Unkown,8/31/18 9:33,10/2/18 0:20 I wrote this but it appears to be too much for Splunk rex field=_raw "(?<ig1>.+?)([,])(?<loc>.+?)([,])(?<ig2>.+?)([,])(?<MacAddress>.+?)([,])(?<modelType>.+?)([,])(?<ig3>.+?)([,])(?<OS>.+?)([,])(?<ig4>.+?)([,])(?<lastSeen>.+?)([,])(?<user>.+?)([,])(?<useremail>.+?)([,])(?<Application>.+?)([,])(?<ig5>.+?)([,])(?<deployed>.+?)([,])(?<public>.+?)([,])(?<assignedVersion>.+?)([,])(?<installedVersion>.+?)([,])(?<ig6>.+?)([,])(?<ig7>.+?)([,])(?<ig8>.+?)([,])(?<status>.+?)([,])(?<installedby>.+?)([,])(?<appFirstSeen>.+?)([,])(?<appUpdatedTime>.+?)([,]|$)" Any suggestions? I cannot edit profs etc. I must do this via regex within the query. Thanks, ... View more