Do you mean | stats count(bppm_message) as Total_count, count(eval(like(closed_with, "%INC%"))) as Closed-With-INC, distinct_count(eval(if(like(closed_with, "%INC%"), closed_with, null()))) as distinct_INC count(eval(if(like(closed_with, "%CRQ%"), closed_with, null()))) as Closed-With-CRQ, distinct_count(if(eval(like(closed_with, "%CRQ%"), closed_with, null()))) as distinct_CRQ count(eval(like(closed_with, "%PKE%"))) as Closed-With-PKE, count(eval(like(closed_with, "%WO%"))) as Closed-With-WO distinct_count(if(eval(like(closed_with, "%WO%"), closed_with, null()))) as distinct_WO by username Again, this is a very messy expression. In fact, the above is going to give you one extra count because null is a distinct value. It is best to clean up the evaluation logic before going into stats. ... View more

By mentioning next week, hope you meant previous week. Can you just print Format_Date and relative_time(now(), "-2w@w") and paste the result for few rows or just manually compare one or two rows to see if it works ... View more

repeat_count is a field which has count of number of alerts ... View more

@harsush, please confirm whether your issue is resolved. ... View more

Just cut-and-paste it. You changed my |lookup boxdata host to |inputlookup boxdata host which, as Splunk says, is incorrect. ... View more

This regex string will extract the fields you need from the text, assuming the order is constant. You can then put them together into the desired output. HOST=(?<Host>\w+) ALIVE_STATUS=(?<STATUS>\w+).*? up (?<up_since>[\d\.]+\s\w+).*?(?<disk>\/\w+) disk used (?<disk_percent>[\d\.]+).*?memory\+swap used (?<mem_percent>[\d\.]+) percent load (?<load>[\d\.]+).*? threads (?<threads>\d+) procs running (?<procs>\d+) procs blocked (?<blocked>\d+) total CPU used over last minute (?<CPU_percent>[\d\.]+).*?i\/o wait over last minute (?<io_percent>[\d\.]+) ... View more

If you want to convert the SLA time to epoch time, then you will need to assume that the SLA date is "today". This can be calculated as: | rex field=SLA "(?<hrs>\d+?)\:(?<min>\d+)" | eval SLA_time_seconds = (hrs * 60 + min) * 60 | eval midnight_today = relative_time(now(),"@d") | eval SLA_epoch_time = midnight_today + SLA_time_seconds ... View more

Always avoid join if you can (and you almost always can); try this: index="ca*" sourcetype="uc4" host="uc*" U0011502 | stats max(_time) AS Completion_Time by JOB | eval Completion_Time_A = strftime(Completion_Time, "%+") | eval Completion_Time_Hour = strftime(Completion_Time, "%H%M") | appendpipe [| inputlookup PROD_BOX_CO | search Job="PROD*" | rename Job AS JOB ] | stats values(*) AS * BY JOB | rex field=SLA mode=sed "s/://" | eval diff = SLA - Completion_Time_Hour | fieldformat SLA = replace(SLA , "(\d{2})$", ":\1") | fieldformat Completion_Time_Hour= replace(Completion_Time_Hour, "(\d{2})$", ":\1") | table CYCLE CheckPoint SLA Completion_Time_A Completion_Time_Hour diff | sort 0 Completion_Time ... View more

This seemed to work for me. Give it a try: index=yourindex | rex field=_raw "jobplan\s(?P<job1>.[^\,]*)" | rex field=_raw "task\s\'(?P<job2>.[^\']*)" | rex field=_raw "Job\s\'(?P<job3>.[^\']*)" | eval job=coalesce(job1,job2,job3) | table job ... View more

Give this a try (the rex commands are truncated, so update them) host=Host1* OR host=Host2* U0011502 earliest=-1d@d latest=now | rex "U0011502 Workflow '(?(?[^.]+)\.[^.]+\.[^.]+\.(?[^.]+\.[^.]+)[^']+)" | search env=CERT (job=AJob OR job= BJob OR job= C) | stats values(_time) as desired_time by job | eval "Completion-Time"=case(mvcount(desired_time)=1 AND mvindex(desired_time,0)>=relative_time(now(),"@d"), strftime(mvindex(desired_time,0), "%d/%m/%Y %I:%M:%S %p") ,mvcount(desired_time)=1 AND mvindex(desired_time,0)<relative_time(now(),"@d"),"Not Yet completed", mvcount(desired_time)=2,strftime(mvindex(desired_time,1), "%d/%m/%Y %I:%M:%S %p"),1=1,"Unknown") | eval "Last-Completion-Time"=case(mvcount(desired_time)=1 AND mvindex(desired_time,0)>=relative_time(now(),"@d"), null() ,mvcount(desired_time)=1 AND mvindex(desired_time,0)<relative_time(now(),"@d"),strftime(mvindex(desired_time,0), "%d/%m/%Y %I:%M:%S %p"), mvcount(desired_time)=2,strftime(mvindex(desired_time,0), "%d/%m/%Y %I:%M:%S %p"),1=1,"Unknown") | eval Delay=if('Completion-Time'="Not Yet completed",tostring(now()-mvindex(desired_time,0),"duration"),"NA") | table job "Completion-Time" "Last-Completion-Time" Delay | rename job as "UC4 Job" ... View more

This generates some test data from your samples | makeresults | eval mydata="2/12/17 8:12:40.866 PM 20170213/203040.866 - U0011502 Workflow 'AJob' (RunID '12111') ended normally. host = host2 source = /xxx/uc4/AutomationEngine/temp/abc.txt sourcetype = uc4 !!!!2/12/17 6:12:06.744 PM 20170213/182906.744 - U0011502 Workflow 'BJob' (RunID '12122') ended normally. host = host1 source = /M/zx/AutomationEngine/temp/def1.txt sourcetype = uc4 !!!!2/14/17 8:30:40.866 PM 20170213/203040.866 - U0011502 Workflow 'AJob' (RunID '14111') ended normally. host = host2 source = /xxx/uc4/AutomationEngine/temp/abc.txt sourcetype = uc4 !!!!2/14/17 6:29:06.744 PM 20170213/182906.744 - U0011502 Workflow 'BJob' (RunID '14122') ended normally. host = host1 source = /M/zx/AutomationEngine/temp/def1.txt sourcetype = uc4 !!!!2/15/17 8:14:40.866 PM 20170213/203040.866 - U0011502 Workflow 'AJob' (RunID '15111') ended normally. host = host2 source = /xxx/uc4/AutomationEngine/temp/abc.txt sourcetype = uc4" | makemv delim="!!!!" mydata | mvexpand mydata | eval _raw = mydata | rex field=_raw "^(?<TheTime>\d+\/\d+\/\d+\s\d+:\d+:\d+\.\d+\s\w+)" | eval _time = strptime(TheTime,"%m/%d/%y %l:%M:%S.%3N %p") | table _time _raw This calculates a report. You probably will have to tweak the format of the "delay" variable" to your liking. | rex field=_raw "host = (?<host>[^\s]+)\s+source = (?<source>[^\s]+)\s+sourcetype = (?<sourcetype>[^\s]+)" | rex field=_raw "Workflow \'(?<job>[^\']+)\' \(RunID \'(?<runid>[^\']+)\'\) ended normally" | stats max(_time) as lasttime by job | eval today=relative_time(now(),"-5h@d") | eval delay = now()-lasttime | eval delay=if(delay<86400,"",round((delay % 86400)/1440,2)." hours") | eval status=if(lasttime<today,"not yet complete", "complete") | eval desired_time=if(status="complete","",strftime(lasttime,"%m-%d-%Y %H:%M:%S %p")) | eval completed_time=if(status="complete",strftime(lasttime,"%m-%d-%Y %H:%M:%S %p"),"") | table job status TheTime completed_time desired_time delay If you wanted to limit the report to only certain jobs, you could either do that in your initial search, or put a join or a lookup table right after the stats command. ... View more