Hello all, I am struggling to find a solution for this. I have two different searches. One shows log entries where system errors have occurred: User Id:              Error code:               Error Time: 121                     E3002189                2021-08-27 12:01:34 249                     E1000874                2021-08-27 12:05:21 121                     E2000178                2021-08-27 12:27:09 The other search shows where the users were/are located throughout the day: User Id:            Location:             Login Time:                                 Logout Time: 121                   P155                     2021-08-27 11:54:56           2021-08-27 12:14:19 121                   U432                     2021-08-27 12:22:16           2021-08-27 12:34:52 249                   M127                    2021-08-27 12:01:32           2021-08-27 12:35:45 249                  J362                      2021-08-27 12:38:25           2021-08-27 12:50:11   I am trying to join the two searches and then compare the times to find the location of a user at the time of an error. So I tried joining on the user id and the basically comparing the unix time of the times above to find Error Time >= Login Time and Error Time <= Logout Time, but that didn't work. How can I set up the search to accomplish this? Thanks in advance! ... View more

Hello, Does anyone know how to pass parameters to a saved search using the splunklib for the Splunk API? I am able to use it to get results from my saved searches, but now I would like to be able to pass a variable value to my saved search. I've seen a few examples of people using the "curl" approach, but I wanted to see if there was a way to do this by directly using the splunklib for Python. This is the snippet of code where I retrieve my saved search and then run it. number_of_users = 10 search_name = "Find Most Recent Users" mysavedsearch = service.saved_searches[search_name] job = mysavedsearch.dispatch()   So if I have a saved search named: Find Most Recent Users And that search looks like:  "index=INDEX host=HOST sourcetype=SOURCETYPE | rex field=_raw "User:(?<user_id>\d+) | where isnotnull(user_id) | head $number_of_users$"   How would I pass the variable "number_of_users" into the above? ... View more

Hi all, I am trying to get the duration of the starting found error based on the affected users and the last fail/success message. For instance, if I have events like this: 2021-06-17 13:15:13 Error Resolve Status Success for Issue submitted by User:132 2021-06-17 13:15:12 Error Resolve Success for Users:131,132,133 submitted_by:132 2021-06-17 13:13:15 Error Resolve Status Failed 2021-06-17 13:13:14 Error Found, Users:131,132,133 affected 2021-06-17 13:13:14 Error Resolve Success for Users:166,167,168 submitted_by:166 2021-06-17 13:12:31 Error Resolve Status Failed 2021-06-17 13:12:31 Error Resolve Success for Users:166,167,168 submitted_by:166 2021-06-17 13:11:47 Error Found, Users:166,167,168 affected   I want to be able to find the duration from 13:11:47 to 13:13:15 for the users 166, 167 and 168, and I want to get the duration from 13:13:14 to 13:15:13 for users 131, 132 and 133. I was originally going to use transactions, but I don't think that would work well here. So how can I write my query to get the durations I'm looking for based on the users affected? Thanks in advance! ... View more

Hello, I have one search where I am finding inventory details for items going into carts and another search for cart status. The two searches have one common field (named differently in each) for the cart location and I am trying to join them to show how many inventory items have been put into each cart and when the last item was put into the cart. Both searches have the same index, host and sourcetype. My search currently looks like this. It's in the works, but I'm stuck. I want it to also show carts that have not had any inventory put into it yet and count the items for each cart (even if it's zero). How can I rewrite this to show the info I want?   index=INDEX host=HOSTNAME sourcetype=SOURCETYPE | rex field=_raw "Cart:\s(?<cart_id>\d+)\sbegin" | rex field=_raw "Cart:\s(?<cart_id>\d+)\sselect\snew\ssection:\s(?<section>\d+)" | rex field=_raw "Cart:\s(?<cart_id>\d+)\sset\scurrent\slocation:\s(?<section_name>\w+-\d+)" | rex field=_raw "Cart:\s(?<cart_id>\d+)\snext\slocation\sis:(?<section_name>\w+-\d+)" | rex field=_raw "Cart:\s(?<cart_id>\d+)\sset\scurrent\slocation:\s\w+-(?<section_number>\d+)" | rex field=_raw "Cart:\s(?<cart_id>\d+)\snext\slocation\sis:\w+-(?<section_number>\d+)" | eval select_time=if(like(_raw, "%select new section%"), _time, null) | eval selected_at=strftime(select_time, "%Y-%m-%d %H:%M:%S") | eval start_time=if(like(_raw, "%begin%"), _time, null) | eval set_time=if(like(_raw, "%set current location%"), _time, null) | eval next_loc_time=if(like(_raw, "%next location%"), _time, null) | where isnotnull(cart_id) and ((like(_raw, "%set current location%") and like(section_name, "AA%")) or like(_raw, "%begin%") or (like(_raw, "%select new section%"))) | eventstats latest(section) as section_id latest(section_name) as section_name latest(section_number) as section_number latest(selected_at) as selected_at by cart_id | where isnotnull(section_name) and (100<=section_id and section_id<=300) | join type=outer left=L right=R where L.section_number=R.new_loc [search index=INDEX host=HOSTNAME sourcetype=SOURCETYPE | rex field=_raw "Move\sItem-(?<item>\w+\-\d+\-\d+\-\d+)\sfrom\sBin-(?<bin_id>\d+)-(?<slot_number>\d+)\sto\sAA-(?<new_loc>\d+)" | where isnotnull(item) | eval moved_at=strftime(_time, "%Y-%m-%d %H:%M:%S") | table item, bin_id, slot_number, new_loc, moved_at] | rename L.cart_id as cart_id, L.section_number as section_number, R.new_loc as new_loc, L.section_name as section_name, R.bin_id as bin_id, R.moved_at as moved_at | table cart_id, new_loc, section_number, section_name, bin_id, moved_at ... View more

Hello all, I have two searches. One is for finding session info/durations and the other is for finding error info/durations. I want to combine the session IDs to my error info table based on whether the error occurred during that session. So for instance, if I have something like this for my session data: 2021-06-14 14:45:12 UserId:123 Session 3 begin 2021-06-14 14:43:43 UserId:123 Session 2 end 2021-06-14 14:40:01 UserId:123 Session 2 begin 2021-06-14 14:33:10 UserId:123 Session 1 end 2021-06-14 14:25:44 UserId:123 Session 1 begin   And I have something like this for my error data: 2021-06-14 14:30:12 UserId:123 Error finish 2021-06-14 14:28:43 UserId:123 Error start   I would want to include session ID 1 to my error info table because an error happened during that session. I currently have a search like this, but it is not working how I want it to. How might I be able to rewrite this to show what I want? Also, if I wanted to just find the next session transaction after the end of an error, how can I do that?   index=INDEX host=HOSTNAME sourcetype=SOURCETYPE | rex field=_raw "UserId:(?<user_id>\d+)" | transaction user_id startswith="start" endswith="finish" | where user_id<2000 | eval start=_time | eval finish=_time+duration | eval error_duration=tostring(duration, "duration") | eval error_start=strftime(start, "%Y-%m-%d %H:%M:%S") | eval error_end=strftime(finish, "%Y-%m-%d %H:%M:%S") | join user_id [search index=INDEX host=HOSTNAME sourcetype=SOURCETYPE_TWO | rex field=_raw "UserId:(?<user_id>\d+)\sSession\s(?<session_id>\d+)" | sort 0 user_id session_id -_time | transaction user_id session_id maxpause=5m endswith="end" | eval begin=_time | eval end=_time+duration | where user_id<2000 | eval duration=tostring(duration, "duration") | table user_id, begin, end, duration, session_id] | where start>=begin and finish<=end | table user_id, session_id, error_start, error_end, error_duration   ... View more

Hello, I have events that look like this: 2021-05-27 14:33:44 UserId:123 Begin Fix for Issue:4354657687    <-- extra/delayed event logged after fix 2021-05-27 14:33:43 UserId:123 Fix Success! 2021-05-27 14:33:01 UserId:123 Begin Fix for Issue:4354657687 2021-05-27 14:32:32 UserId:123 Begin Fix for Issue:4354657687 2021-05-27 14:32:08 UserId:123 Begin Fix for Issue:4354657687 2021-05-27 14:31:47 UserId:123 Fix Success! 2021-05-27 14:31:25 UserId:123 Begin Fix for Issue:4353228391 I am making a search to return instances where a new issue has started but has not yet been fixed. If I grab the latest event and it begins with "Begin Fix" I am currently taking that and using it to calculate the duration where an issue is considered "ongoing". However, in some cases, my events occur so that there is an extra event with the same issue id that occurs AFTER the fix has occurred.  How should I go about this to only grab the latest event if its issue id has not been fixed yet? ... View more

Hello, I am trying to get only the events from my logs that have started a task (in this case, going to a room) and have not ended their task. So for instance I may have two different set of events for a user (each example is below). In this first example, I would want to retrieve the fourth event because it is the latest "Go To Room" (or start task) that starts but does not have another event letting us know that it had left room 28 (there isn't an end task with the same field value of 28). 2021-05-21 16:34:22 UserId:123 Exit Room: 26 2021-05-21 16:34:12 UserId:123 Exit Room: 24 2021-05-21 16:34:08 UserId:123 Exit Room: 25 2021-05-21 16:33:59 UserId:123 Go To Room: 28 2021-05-21 16:33:52 UserId:123 Exit Room: 23   In this second example, I would NOT want to retrieve anything because the latest "Go To Room" task is finished with an "Exit Room" task with a matching field value of 28. 2021-05-21 16:34:22 UserId:123 Exit Room: 26 2021-05-21 16:34:12 UserId:123 Exit Room: 28 2021-05-21 16:34:08 UserId:123 Exit Room: 25 2021-05-21 16:33:59 UserId:123 Go To Room: 28 2021-05-21 16:33:52 UserId:123 Exit Room: 23   How should I go about this to retrieve the events I want? ... View more