I am trying to arrange some information received in a CSV file in a table format (as per example) The two searches I used was as follow: Search 1 index="labour" | stats sum(Hours) as TotalHours BY Client_Name, Resource | streamstats sum(Hours) BY Client_Name, Resource | stats list(Resource) as Resource_Name, list(TotalHours) as "Per Resource", sum(TotalHours) as TotalHours by Client_Name Result: Client_Name Resource_Name Per Resource TotalHours Client 3 Resource 1 8 12 Resource 5 4 Search 2 index="labour" | stats first(Tper) as Week by Hours, Client_Name, Resource | xyseries Client_Name Week Hours | addtotals Result: Client_Name Week25 Week26 Total Client 3 6 6 12 Hope someone can make sense of this to assist me please. Thanks in advance! ... View more

Hi Splunkers I need some assistance with a search. I need to add the values of a Field and then use them in a stats command. The field name is "MyField" and the values and Count are: Requests 389 Advices 233 I need to add Requests and Advices together and then use them in a stats command as Field "MyFieldTotals" Thanks in advance ... View more

I posted a question earlier this month regarding Response Time with an additional calculation. What I need now, is help with doing the same search, but with a timechart, hourly interval. Example Time Average Response Time date 13:00 0.528 date 14:00 0.896 etc. My current search is index=myindex* host="server" Message_Type="99*" OR Message_Type="91*" OR Message_Type="92*" OR Message_Type="94*" source=EasyPayVAGAS | dedup Message_Type, UUID | stats first(_time) as begin last(_time) as end by UUID | eval responsetime=begin-end | eval Response_Time=if(responsetime>45,"45.000",responsetime) | stats avg(Response_Time) as Response_Time | eval RT_Avg=round(Response_Time,3) | table RT_Avg Any assistance will be appreaciated, thanks! ... View more

Good day I read a few answers on the WinEventLog:Security filtering but it does not cover the answers I'm looking for. I need to filter out event codes but only the ones that contain an Account_Name: Local Service entry. The regex that I'm using in transforms.conf on the Indexers does not work: props.conf [WinEventLog:Security] TRANSFORMS-evtlog = eventnull TRANSFORMS-wfevtlog = wfeventnull transforms.conf eventnull^EventCode=(560|562|4656|4658|4663)[\s\S]+?^Account\sName:\s+(?:(?:LOCAL\sSERVICE)|(?:.*?\$$)) DEST_KEY=queue FORMAT=nullQueue [wfeventnull] REGEX=(?m)^EventCode=(5152|5156|5157|5158) DEST_KEY=queue FORMAT=nullQueue Here is an example of the event I'm try to filter out: 05/18/2014 10:11:31 PM LogName=Security SourceName=Microsoft Windows security auditing. EventCode=4656 EventType=0 Type=Information ComputerName=server.domain.local TaskCategory=File System OpCode=Info RecordNumber=123456789 Keywords=Audit Success Message=A handle to an object was requested. Subject: Security ID: NT AUTHORITY\LOCAL SERVICE Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Object: Object Server: Security Object Type: File Object Name: \Device\Udp6 Handle ID: 0xc930 Process Information: Process ID: 0x1ac Process Name: C:\Windows\System32\svchost.exe Access Request Information: Transaction ID: {00000000-0000-0000-0000-000000000000} Accesses: READ_CONTROL SYNCHRONIZE Execute/Traverse ReadAttributes Access Reasons: - Access Mask: 0x1200a0 Privileges Used for Access Check: - Restricted SID Count: 0 ... View more

Hi there Splunkers I need some assistance with a search. We are calculating the response time between transactions by taking the last event and deducting if from the first event. That all works perfectly in this search: index="my_index* host="the_host*" sourcetype=my_sourcetype Message_Type="123" OR Message_Type="456" | rex field=_raw "\d+:\d+:\d+\.(?<MilliSeconds>\d+)" | eval calctime=(_time*1000) | eval newtime=calctime+MilliSeconds | stats latest(newtime) as end earliest(newtime) as begin by UUID | eval responsetime=end-begin | eval Response_Time=round(responsetime/1000,3) | stats max(Response_Time) as Response_Time | chart first(Response_Time) as RT_Max The challenge is to create a second scenario where, if the time exceeds 45.001 seconds (say, 54.269 or 67.598 seconds), then it should return a value of 45.000 seconds where the value still need to be calculable in the search.... I tried to use the "eval if" command but it gives and error eval if(newtime=<"45.001", "45.000", newtime) Any assistance will be appreciated, thanks. ... View more