This challenge was first posted on Slack #puzzles channel For a previous puzzle, I needed a set of fixed-length pipe-delimited events, so I took a public domain data set, which happened to be in XML format and converted it to the required format. The overall aim of this puzzle is to convert XML event to fixed-length events, and it has been split into multiple parts. The first part was about preparing the field template by dereferencing the field names, so that their positions could be compared. This second part is about an alternative approach to the field template process. To that end, the challenge for this part is to take some XML events and determine the correct order that the fields appear in by using nested loops to process each sequence segment against all the other sequences, and merging or joining the sequence segments until the whole sequence is determined. Using the same example set of events from the previous part: <row num="1600"><Mercury>0</Mercury><Venus>0</Venus><Earth>1</Earth></row> <row num="1625"><Jupiter>97</Jupiter></row> <row num="1675"><Saturn>274</Saturn></row> <row num="1800"><Saturn>274</Saturn><Uranus>29</Uranus></row> <row num="1850"><Saturn>274</Saturn><Neptune>16</Neptune></row> <row num="1875"><Uranus>29</Uranus></row> <row num="1900"><Earth>1</Earth><Mars>2</Mars><Jupiter>97</Jupiter><Saturn>274</Saturn></row> <row num="1950"><Jupiter>97</Jupiter><Uranus>29</Uranus><Neptune>16</Neptune></row> <row num="1975"><Jupiter>97</Jupiter><Saturn>274</Saturn></row> <row num="2000"><Jupiter>97</Jupiter><Saturn>274</Saturn><Uranus>29</Uranus><Neptune>16</Neptune></row> Develop a process to join sequences where they start and end with the same planet, and expand sequences where another sequence has one or more planets between a pair of planets which are consecutive in the sequence. Create a tilde-delimited template for the fields in this set of XML events. This article contains spoilers! In fact, most of this article is a spoiler as it contains partial solutions to the puzzle. If you are trying to solve the puzzle yourself and just want some pointers to get you started, stop reading when you have enough, and return if you get stuck again, or just want to compare your solution to mine! Field sequences This puzzle has been split into multiple parts. This second part is about an alternative approach to the field template process. Using the same example set of events from the previous part: <row num="1600"><Mercury>0</Mercury><Venus>0</Venus><Earth>1</Earth></row> <row num="1625"><Jupiter>97</Jupiter></row> <row num="1675"><Saturn>274</Saturn></row> <row num="1800"><Saturn>274</Saturn><Uranus>29</Uranus></row> <row num="1850"><Saturn>274</Saturn><Neptune>16</Neptune></row> <row num="1875"><Uranus>29</Uranus></row> <row num="1900"><Earth>1</Earth><Mars>2</Mars><Jupiter>97</Jupiter><Saturn>274</Saturn></row> <row num="1950"><Jupiter>97</Jupiter><Uranus>29</Uranus><Neptune>16</Neptune></row> <row num="1975"><Jupiter>97</Jupiter><Saturn>274</Saturn></row> <row num="2000"><Jupiter>97</Jupiter><Saturn>274</Saturn><Uranus>29</Uranus><Neptune>16</Neptune></row> We can see that row 1600 ends with Earth, and row 1900 starts with Earth. These can be combined to have Mercury -> Venus -> Earth -> Mars -> Jupiter -> Saturn. Furthermore, row 1850 shows Saturn -> Neptune; this can be expanded to be Saturn -> Uranus -> Neptune, because row 2000 shows Jupiter -> Saturn -> Uranus -> Neptune. To that end, the challenge for this part is to find all the possible sequences of the field names without compromising the overall integrity of the series of sequences, and combine and expand overlaps. Planets in order As we did in the previous part, using the planet data, we can create a template for the fields present in each event: | makeresults format=csv data="row <row num=\"1600\"><Mercury>0</Mercury><Venus>0</Venus><Earth>1</Earth></row> <row num=\"1625\"><Jupiter>97</Jupiter></row> <row num=\"1675\"><Saturn>274</Saturn></row> <row num=\"1800\"><Saturn>274</Saturn><Uranus>29</Uranus></row> <row num=\"1850\"><Saturn>274</Saturn><Neptune>16</Neptune></row> <row num=\"1875\"><Uranus>29</Uranus></row> <row num=\"1900\"><Earth>1</Earth><Mars>2</Mars><Jupiter>97</Jupiter><Saturn>274</Saturn></row> <row num=\"1950\"><Jupiter>97</Jupiter><Uranus>29</Uranus><Neptune>16</Neptune></row> <row num=\"1975\"><Jupiter>97</Jupiter><Saturn>274</Saturn></row> <row num=\"2000\"><Jupiter>97</Jupiter><Saturn>274</Saturn><Uranus>29</Uranus><Neptune>16</Neptune></row>" ``` Create a sequence of fields used in the event ``` | eval fieldnames=mvjoin(fields,"~") Field combinations Ideally, we would like to process each field name (planet) combined with every other field name (planet) to check if this combination is found in the data. If this was written in pseudo-code, it might look something like this: For x in planets For y in planets Does x followed by y exist is the data The closest thing to this (without writing a custom search command), is to use the foreach command. This command requires a field list, so let us generate a set of fields for the planets. Perhaps the simplest way to do this is with the chart command: ``` Create a set of fields for the planets ``` | chart values(eval(0)) by fieldnames fields This gives us a zero every time the planet represented by the field is used in the field name sequence, but more importantly, it gives us a field named for each planet. Now we can try to process each planet against every other planet: ``` Create a cross-product of the planets ``` | foreach * [| eval planet_one="<<FIELD>>" | foreach * [| eval planet_two="<<FIELD>>" | eval cross_product=mvappend(cross_product,planet_one."~".planet_two)] ] As you can see, this does not work as we would have liked. There are two problems: firstly, the fieldnames field has been processed; secondly, and more frustratingly, the nested foreach does not override the value of the <<FIELD>> variable (you might call this scope-bleed or globalisation of <<FIELD>> variable?). The following SPL is a simple test to demonstrate what is going on: ``` Create a cross-product of the planets ``` | foreach * [| eval planet_one="<<FIELD>>" | foreach 1 2 3 [| eval planet_two="<<FIELD>>" | eval cross_product=mvappend(cross_product,planet_one."~".planet_two)] ] There are three repetitions for each of the fields with both planet_one and planet_two being identical (and using the value of the <<FIELD>> variable from the outer foreach). Nested loops Since we want to process all the other planets, perhaps it would be better to replace the zero with a complete list of the planets: ``` Create a set of fields for the planets ``` | eventstats values(fields) as field | chart values(field) by fieldnames fields This gives us a list of all the planets every time the planet represented by the field is used in the field name sequence. Now we can use foreach in multivalue mode to process each field against all the other fields. ``` Rename fieldnames so it is not picked up by foreach ``` | rename fieldnames as _fieldnames ``` For each field ... ``` | foreach * [ ``` (Nested) for each value in the multivalue field ... ``` | foreach mode=multivalue <<FIELD>> [ Now we can check for sequences of field names and add them to a list of sequences, if either the field names directly or indirectly follow each other. ``` Build a list of field name sequences present in the current sequence with the following conditions: i) outer fieldname does not match inner fieldname, and a) outer fieldname is directly followed by inner fieldname (add direct pairing to the list), or b) outer fieldname is indirectly followed by inner fieldname (add all intervening fieldnames) ``` | eval sequence=if("<<FIELD>>”=<<ITEM>>, sequence, if(match(_fieldnames,"<<FIELD>>"."~".<<ITEM>>), mvappend(sequence,"<<FIELD>>"."~".<<ITEM>>), if(match(_fieldnames,"<<FIELD>>"."~[\w~]+~".<<ITEM>>), mvappend(sequence,mvjoin(mvindex(split(_fieldnames,"~"),mvfind(split(_fieldnames,"~"),"<<FIELD>>"),mvfind(split(_fieldnames,"~"),<<ITEM>>)),"~")), sequence))) Note that, as we discovered earlier, the variable <<FIELD>> in the inner foreach refers to the field from the outer foreach. Also note that, the <<ITEM>> variable is already a string value, whereas <<FIELD>> is the field value so needs to be double-quoted to use it as a string. For clarity, this could be rewritten as: ``` For each field ... ``` | foreach * [ | eval field_one="<<FIELD>>" ``` (Nested) for each value in the multivalue field ... ``` | foreach mode=multivalue <<FIELD>> [ ``` Build a list of field name sequences present in the current sequence with the following conditions: i) outer fieldname does not match inner fieldname, and a) outer fieldname is directly followed by inner fieldname (add direct pairing to the list), or b) outer fieldname is indirectly followed by inner fieldname (add all intervening fieldnames) ``` | eval field_two=<<ITEM>>, sequence=if(field_one=field_two,sequence,if(match(_fieldnames,field_one."~".field_two),mvappend(sequence,field_one."~".field_two),if(match(_fieldnames,field_one."~[\w~]+~".field_two),mvappend(sequence,mvjoin(mvindex(split(_fieldnames,"~"),mvfind(split(_fieldnames,"~"),field_one),mvfind(split(_fieldnames,"~"),field_two)),"~")),sequence))) ] ] Note that, foreach mode=multivalue only allows a single command to be used, however, multiple fields can be evaluated in a single eval command by separating them with commas. Overlaps and expansions Now that we have a list of field sequences, we need to look for opportunities to expand sequences where they end where another one starts, or start where another one ends, or where they contain a consecutive sequence which matches the start and end of another sequence. ``` Create a list of unique sequences ``` | stats count by sequence ``` Make complete list available to each sequence ``` | eventstats values(sequence) as sequences Move the current sequence out of the way so we can create a new set of sequences ``` Move existing sequence out of the way so we can create a new list ``` | rename sequence as _sequence For each of the sequences, create a new list of sequences containing, the current sequence, expanded sequences where the start of the other matches the start of the current sequence, or where the end of the other matches the start of the current sequence, or where the start and end of the other sequence match a consecutive pair in the current sequence. ``` For each sequence (event), compare all the other sequences ``` | foreach mode=multivalue sequences [ | eval sequence=if(_sequence=<<ITEM>>,mvappend(sequence,_sequence),if(mvindex(split(<<ITEM>>,"~"),0)=mvindex(split(_sequence,"~"),-1),mvappend(sequence,_sequence."~".mvjoin(mvindex(split(<<ITEM>>,"~"),1,-1),"~")),if(mvindex(split(<<ITEM>>,"~"),-1)=mvindex(split(_sequence,"~"),0),mvappend(sequence,mvjoin(mvindex(split(<<ITEM>>,"~"),0,-2),"~")."~"._sequence),if(match(_sequence,mvindex(split(<<ITEM>>,"~"),0)."~".mvindex(split(<<ITEM>>,"~"),-1)),mvappend(sequence,replace(_sequence,mvindex(split(<<ITEM>>,"~"),0)."~".mvindex(split(<<ITEM>>,"~"),-1),<<ITEM>>)),sequence))) ] Since we do not appear to have found the full sequence yet, I will leave you to work out which steps need to be repeated, and by how many times until the complete sequence is discovered. Have questions or thoughts? Comment on this article or in Slack #puzzles channel. Whichever you prefer. ... View more

This challenge was first posted on Slack #puzzles channel For a previous puzzle, I needed a set of fixed-length pipe-delimited events, so I took a public domain data set, which happened to be in XML format and converted it to the required format. The overall aim of this puzzle is to convert XML event to fixed-length events, and it has been split into multiple parts. This first part is about preparing the field template so that it can be used to place the data in the correct order in the fixed-length (and pipe-delimited) events. To that end, the challenge for this part is to take some XML events and determine the correct order that the fields appear in. The approach requires determining, for each event, where each field exists in the sequence and comparing it with the position of every other field by dereferencing the field names to find their positions. An example would be the following set of events: <row num="1600"><Mercury>0</Mercury><Venus>0</Venus><Earth>1</Earth></row> <row num="1625"><Jupiter>97</Jupiter></row> <row num="1675"><Saturn>274</Saturn></row> <row num="1800"><Saturn>274</Saturn><Uranus>29</Uranus></row> <row num="1850"><Saturn>274</Saturn><Neptune>16</Neptune></row> <row num="1875"><Uranus>29</Uranus></row> <row num="1900"><Earth>1</Earth><Mars>2</Mars><Jupiter>97</Jupiter><Saturn>274</Saturn></row> <row num="1950"><Jupiter>97</Jupiter><Uranus>29</Uranus><Neptune>16</Neptune></row> <row num="1975"><Jupiter>97</Jupiter><Saturn>274</Saturn></row> <row num="2000"><Jupiter>97</Jupiter><Saturn>274</Saturn><Uranus>29</Uranus><Neptune>16</Neptune></row> For example, Mercury has a lower index in the sequence, i.e. is to the left of Venus, which has a lower index in the sequence, i.e. is to the left of Earth, and, in a different sequence, Jupiter has a lower index, i.e. is to the left of Saturn. Create a tilde-delimited template for all the fields in this set of XML events. For a partial example Mercury~Venus~Earth An optional bonus question is to explain what the data represents. This article contains spoilers! In fact, most of this article is a spoiler as it contains partial solutions to the puzzle. If you are trying to solve the puzzle yourself and just want some pointers to get you started, stop reading when you have enough, and return if you get stuck again, or just want to compare your solution to mine! Preparing the field template This puzzle has been split into multiple parts. This first part is about preparing the field template  so that it can be used to place the data in the correct order in the fixed-length (and pipe-delimited) events. To that end, the challenge for this part is to take some XML events and determine the correct order that the fields appear in. A simple example would be the following set of events: <row num="1"><john>L</john><paul>M</paul><ringo>S</ringo></row> <row num="2"><john>L</john><george>H</george><ringo>S</ringo></row> <row num="3"><john>L</john><paul>M</paul><george>H</george></row> Here, john has a lower index in the sequence, i.e. is to the left of paul, and paul has a lower index in the sequence, i.e. is to the left of ringo. A more complex example would be the following set of events: <row num="1600"><Mercury>0</Mercury><Venus>0</Venus><Earth>1</Earth></row> <row num="1625"><Jupiter>97</Jupiter></row> <row num="1675"><Saturn>274</Saturn></row> <row num="1800"><Saturn>274</Saturn><Uranus>29</Uranus></row> <row num="1850"><Saturn>274</Saturn><Neptune>16</Neptune></row> <row num="1875"><Uranus>29</Uranus></row> <row num="1900"><Earth>1</Earth><Mars>2</Mars><Jupiter>97</Jupiter><Saturn>274</Saturn></row> <row num="1950"><Jupiter>97</Jupiter><Uranus>29</Uranus><Neptune>16</Neptune></row> <row num="1975"><Jupiter>97</Jupiter><Saturn>274</Saturn></row> <row num="2000"><Jupiter>97</Jupiter><Saturn>274</Saturn><Uranus>29</Uranus><Neptune>16</Neptune></row> For example, Mercury has a lower index in the sequence, i.e. is to the left of Venus which has a lower index in the sequence, i.e. is to the left of Earth, and Jupiter has a lower index in the sequence, i.e. is to the left of Saturn. Create a tilde-delimited template for the fields in these sets of XML events. Field names By inspecting the data set, we can see that all the first level fields that we are interested in have simple word character names. This means that they can be extracted using a regular expression. | rex max_match=0 "\<(?<fields>\w+)\>" This creates a multi-value field (fields) with the fieldnames in the order they are found in the event. By joining these values (using a neutral delimiter, I chose a tilde (~) so it does not cause complications with regular expressions further down the line), we can create an initial template for each event. | eval fieldnames=mvjoin(fields,"~") Looking at these fieldname templates, you can see that they are not all the same. This is because not all fields are present in all the events. Fortunately, fieldnames are not repeated in any single template, and there are enough examples of different templates to be able to determine the full and correct order. This is not always guaranteed as duplicated fieldnames and/or a smaller data set could present problems. For example, consider the following two events: <row num="1"><john>L</john><paul>M</paul><ringo>S</ringo></row> <row num="2"><john>L</john><george>H</george><ringo>S</ringo></row> These would have the following templates: john~paul~ringo john~george~ringo Trying to combine these sequence, which of these would represent the full template? john~paul~george~ringo john~george~paul~ringo With these two events, there is insufficient information to determine this. But add a further event example: <row num="3"><john>L</john><paul>M</paul><george>H</george></row> With the following template: john~paul~george The full template can now be determined, even when none of the individual events has this complete template: john~paul~george~ringo Planets in order Turning to Splunk now, by taking the planet data as an example, we can create a template for the fields present in each event: | makeresults format=csv data="row <row num=\"1600\"><Mercury>0</Mercury><Venus>0</Venus><Earth>1</Earth></row> <row num=\"1625\"><Jupiter>97</Jupiter></row> <row num=\"1675\"><Saturn>274</Saturn></row> <row num=\"1800\"><Saturn>274</Saturn><Uranus>29</Uranus></row> <row num=\"1850\"><Saturn>274</Saturn><Neptune>16</Neptune></row> <row num=\"1875\"><Uranus>29</Uranus></row> <row num=\"1900\"><Earth>1</Earth><Mars>2</Mars><Jupiter>97</Jupiter><Saturn>274</Saturn></row> <row num=\"1950\"><Jupiter>97</Jupiter><Uranus>29</Uranus><Neptune>16</Neptune></row> <row num=\"1975\"><Jupiter>97</Jupiter><Saturn>274</Saturn></row> <row num=\"2000\"><Jupiter>97</Jupiter><Saturn>274</Saturn><Uranus>29</Uranus><Neptune>16</Neptune></row>" ``` Find all relevant field names ``` | rex field=row max_match=0 "\<(?<fields>\w+)\>" ``` Create a sequence of fields used in the event ``` | eval fieldnames=mvjoin(fields,"~") This contains the following information: fieldnames fields Mercury~Venus~Earth Mercury Venus Earth Jupiter Jupiter Saturn Saturn Saturn~Uranus Saturn Uranus Saturn~Neptune Saturn Neptune Uranus Uranus Earth~Mars~Jupiter~Saturn Earth Mars Jupiter Saturn Jupiter~Uranus~Neptune Jupiter Uranus Neptune Jupiter~Saturn Jupiter Saturn Jupiter~Saturn~Uranus~Neptune Jupiter Saturn Uranus Neptune To get the names of the planets as fields, place this information in a chart with an initial value of zero: ``` Chart the fields used in the fieldname sequences ``` | eval minimum=0 | chart max(minimum) by fieldnames fields fieldnames Earth Jupiter Mars Mercury Neptune Saturn Uranus Venus Earth~Mars~Jupiter~Saturn 0 0 0     0     Jupiter   0             Jupiter~Saturn   0       0     Jupiter~Saturn~Uranus~Neptune   0     0 0 0   Jupiter~Uranus~Neptune   0     0   0   Mercury~Venus~Earth 0     0       0 Saturn           0     Saturn~Neptune         0 0     Saturn~Uranus           0 0   Uranus             0   Find the index of each named field in each field sequence: ``` Find the index of each field named in each sequence ``` | eval fields=split(fieldnames,"~") | rename fieldnames as _fieldnames, fields as _fields | foreach * [| eval <<FIELD>>=mvfind(_fields,"<<FIELD>>")] Note the rename of fieldnames and fields, so that they do not get picked up by the * on the foreach command. Earth Jupiter Mars Mercury Neptune Saturn Uranus Venus 0 2 1     3       0               0       1       0     3 1 2     0     2   1   2     0       1           0             1 0               0                 0   Notice that some planets have multiple entries and that not all the entries for a planet are the same. This is because the planet appears in more than one sequence and that there may be different numbers of planets appearing before it in the sequence. So, which is right? In fact, nearly all of them are wrong. How do we find the correct order? Finding the right order To find the right order, we can start with the maximum value for each planet, i.e. the one representing where it is furthest to the right in any sequence. ``` Find the maximum index of each field named in each sequence i.e. the furthest to the right that the field appears in any sequence ``` | eventstats max(*) as * Earth Jupiter Mars Mercury Neptune Saturn Uranus Venus 2 2 1 0 3 3 2 1 Rows removed from tables to save space. So far, we have been dealing with the sequences as a whole; now we need to deal with each field in each sequence separately. What we would really like to do is find the value of the index for the first field named in the sequence, and add 1 to it for each of the remaining fields listed in the sequence. Reverse dereferencing Unfortunately, SPL does not have a direct way to dereference the field name to find the corresponding field value. So, we will have to try a different approach. Start by expanding out the field names used in each sequence so we can process them separately: ``` Split out the fieldnames used in each sequence ``` | rename _fieldnames as fieldnames, _fields as fields | mvexpand fields fieldnames Earth Jupiter Mars Mercury Neptune Saturn Uranus Venus fields Earth~Mars~Jupiter~Saturn 2 2 1 0 3 3 2 1 Earth Earth~Mars~Jupiter~Saturn 2 2 1 0 3 3 2 1 Mars Earth~Mars~Jupiter~Saturn 2 2 1 0 3 3 2 1 Jupiter Earth~Mars~Jupiter~Saturn 2 2 1 0 3 3 2 1 Saturn Find the position of each field in its sequence (as an index): ``` Find the current position of the field in its sequence ``` | streamstats count as _position by fieldnames ``` Convert to index ``` | eval _position=_position-1 Earth Jupiter Mars Mercury Neptune Saturn Uranus Venus fields position 2 2 1 0 3 3 2 1 Earth 0 2 2 1 0 3 3 2 1 Mars 1 2 2 1 0 3 3 2 1 Jupiter 2 2 2 1 0 3 3 2 1 Saturn 3 For each sequence, find the current rightmost position of the starting field (effectively, dereferencing the first named planet field): ``` For each sequence, find the current rightmost position of the start ``` | rename fieldnames as _fieldnames, fields as _fields | fields - _start | foreach * [| eval _start=if("<<FIELD>>"=_fields AND _position=0,<<FIELD>>,_start)] | eventstats min(_start) as _start by _fieldnames Earth Jupiter Mars Mercury Neptune Saturn Uranus Venus fields position start 2 2 1 0 3 3 2 1 Earth 0 2 2 2 1 0 3 3 2 1 Mars 1 2 2 2 1 0 3 3 2 1 Jupiter 2 2 2 2 1 0 3 3 2 1 Saturn 3 2 Calculate the new position based on the relative position in the sequence and the rightmost position of the first field ``` Calculate the new position based on the relative position in the sequence and the rightmost position of the first field ``` | eval _new_position=_start+_position Earth Jupiter Mars Mercury Neptune Saturn Uranus Venus fields new position position start 2 2 1 0 3 3 2 1 Earth 2 0 2 2 2 1 0 3 3 2 1 Mars 3 1 2 2 2 1 0 3 3 2 1 Jupiter 4 2 2 2 2 1 0 3 3 2 1 Saturn 5 3 2 When the new position is greater than the field's current rightmost position, update the field's position: ``` When the new position is greater than the field's current rightmost position, update the field's position ``` | foreach * [| eval <<FIELD>>=if("<<FIELD>>"=_fields AND _new_position><<FIELD>>,_new_position,<<FIELD>>)] Earth Jupiter Mars Mercury Neptune Saturn Uranus Venus fields new position position start 2 2 1 0 3 3 2 1 Earth 2 0 2 2 2 3 0 3 3 2 1 Mars 3 1 2 2 4 1 0 3 3 2 1 Jupiter 4 2 2 2 2 1 0 3 5 2 1 Saturn 5 3 2 Find the new maximum index of each field named in each sequence ``` Find the new maximum index of each field named in each sequence ``` | eventstats max(*) as * Earth Jupiter Mars Mercury Neptune Saturn Uranus Venus fields new position position start 2 4 3 0 5 5 4 1 Earth 2 0 2 2 4 3 0 5 5 4 1 Mars 3 1 2 2 4 3 0 5 5 4 1 Jupiter 4 2 2 2 4 3 0 5 5 4 1 Saturn 5 3 2 Are we done yet? There are a couple of ways to tell whether we have found the correct order yet (which can be done visually, or as a stretch exercise). Firstly, more than one planet has the same position as another, and secondly, the maximum index position is less than 7. Since we do not appear to have finished, I will leave you to work out which steps need to be repeated, and by how many times. Generating the final template? Once all the necessary repetitions have been done, we need to convert the information into a template. This can be done by finding the final position for each field and sorting them. ``` Find the final position for each field and sort them ``` | rename _fieldnames as fieldnames | untable fieldnames field position | stats values(position) as position by field | sort 0 position Create a template from the sorted list of fields ``` Create a template from the sorted list of fields ``` | stats list(field) as fields | eval fields=mvjoin(fields,"~") You should now have a process for generating the template required for the planets data set. Have questions or thoughts? Comment on this article or in Slack #puzzles channel. Whichever you prefer. ... View more

Welcome to the Splunk Puzzle Playground If you are anything like me, you love to solve problems, and what better way to do it than with Splunk! Expand your Splunkiverse by learning and using lesser known/used commands, techniques, and data analysis insights to solve innovative puzzles and challenges. The Slack channel The Slack #puzzles channel has been specifically set up as an arena for having fun both with setting and solving puzzles. It is a fun channel for anyone to post puzzles etc. and for others to respond with solutions, queries and spoilers, which demonstrate some of the fun things that can be done with Splunk. Think about it as being mini (or maxi) versions of B.O.R.E. (Boss Of Regular Expressions) and/or SPLing Bee and/or B.O.T.S. (Boss Of The SOC) all year round, not just for the few hours we get at .conf! All levels The puzzles are open to all levels, and, depending on your level of expertise, they could take anything from just a few minutes (which you might do in your breaks - to relax?) to something more challenging (which may take multiple breaks over several days to completely nail!). You do not need to be an expert with Splunk, and if you get stuck, or want some pointers, just ask; there is no shame in the willingness to learn! Monthly puzzles I aim to have a new puzzle every month and would welcome contributions from others in this regard. You do not necessarily need to have a solution yourself (although it might be helpful if you did), as it could be a problem you are struggling with and want some help. If you need help framing your puzzle, please reach out to me and I will do what I can to help. Please bear in mind that data sets (where needed for the puzzle) would have to be non-NDA, non-proprietary, non-confidential, basically public-domain and freely available e.g. Splunk Tutorial, Montgomery County, github, etc., or generated, e.g. eventgen, makeresults, gentimes, etc. or posted in regex101.com, for example. Answers and solutions The puzzles can be answered and commented on in the Slack channel, for example, if you would like some hints, or have some hints for others. I will also usually try to have a Community Blog post published after about a week, giving hints and sometimes partial solutions to help guide people to solving the puzzles. Have questions or thoughts? Comment on this article or in Slack #puzzles channel. Whichever you prefer. ... View more