Thank you very much for your help. The code that works  🙂 ------- index=firewall event_type="error" [search index=firewall sourcetype="metadata" enforcement_mode=block | dedup host1 | table host1 | format] | dedup host | table event_type, host, ip ----------- ... View more

Something in my solution is not right. It works for only one condition (one or another) but combined produced zero events --------- Events reported  ----------- index=firewall (sourcetype=collector OR sourcetype=metadata) enforcement_mode=block |table event_type, hostname, ip ------------- Events reported ----------- index=firewall (sourcetype=collector OR sourcetype=metadata) event_type="error" |table event_type, hostname, ip ------------ No events reported index=firewall (sourcetype=collector OR sourcetype=metadata) enforcement_mode=block event_type="error" |table event_type, hostname, ip ... View more

Something in my solution is not right. It works for only one condition (one or another) but combined produced zero events --------- Events index=firewall (sourcetype=collector OR sourcetype=metadata) enforcement_mode=block |table event_type, hostname, ip ------------- Events index=firewall (sourcetype=collector OR sourcetype=metadata) event_type="error" |table event_type, hostname, ip ------------ No events index=firewall (sourcetype=collector OR sourcetype=metadata) enforcement_mode=block event_type="error" |table event_type, hostname, ip -------------- ... View more

Since it's the same index with two different source types, could be SPL build differentially? ------------------- index=firewall (sourcetype=collector OR sourcetype=metadata) enforcement_mode=block event_type="error" |table event_type, hostname, ip Thank you   ... View more

Thank you. Because in different data source I see host name under different fields  i.e. in metadata "host1" and in collector just "host", I added rename index=firewall event_type="error" [search index=firewall sourcetype="metadata" enforcement_mode=block | rename host1 as host |dedup host | table host | format] | table event_type, host, ip -------- Now I am back to square 1  - it runs but no events produced and never finish. ... View more

Thank you.  Unfortunately proposed change produced 0 events ... View more

Thank you for all updates. Due to large number of devices I decided to use method #2 from the last post. My SPL looks like ------- index=index2 OR (index=index1 sourcetype="metadata" "health.severity"!=NULL) | eval IP_ADDRESS=if(index=index1, interfaces.address, PRIMARY_IP_ADDRESS) ```PRIMARY_IP_ADDRESS is from index2 to match interfaces.address from index1111 | stats dc(index) as indexes values(DISCOVERED_OS) as DISCOVERED_OS by interfaces.address | where indexes=2 | table IP_ADDRESS ________ Query runs with no errors, but produced 0(zero) events 🙂 Thank you, Leon ... View more

I think I got it. Need properly configure "_time" depend on difference in days i.e. for week long difference  eval _time = _time + 7*86400. If I am wrong, please advise. ... View more

I see report by ReportKey now, but graph is leaner I wonder how I can get something like one in articale. ... View more

Thank you very much. ... View more

Gents. Thank you very much. Proper placement of camas and double quotes solved the issue ------------ ... View more

Thank you for recommendations.  Gut an error: Error in 'EvalCommand': The expression is malformed. Expected ). Am I need double (()) around entire statement?   ... View more

Thank you for an update. I tried suggested SPL and added rename field to see if data exists ------------------- | eval Date = strftime(strptime("policy_applied_at","%FT%T.%6NZ"), "%b-%d-%Y") | eval Time = strftime(strptime("policy_applied_at","%FT%T.%6NZ"), "%H:%M") | rename "policy_applied_at" as "Last Refresh Time" | table "Last Refresh Time", Date, Time ------------- The rename, but not trimmed field has data, other two are empty Last Refresh Time Date Time 2024-02-19T11:16:58.930104Z     2024-02-19T11:16:54.980418Z     2024-02-19T11:18:44.875386Z     ... View more

Hello and thank you everyone for the help. What i try to get out the existing data (2024-01-08T04:53:13.028149Z) : UdateDate - YYYY-MM-DD i.e. 2021-08-02 UpdateTime - HH:MM i.e. 13:36 ... View more

Thank you for the reply. The end goal of the exercise is to build report for agents that are not updated in last 24 hours and mot updated in last 7 days. That is why I try to extract last time of update and last date of update.  ... View more

Table format get changed Please see picture instead   ... View more

Thank you for an update. Looks like I am missing something. Eval statements do not produce the results My SPL statement --Query------ Index=xyz  | eval evTime=strptime(agent.status.policy_refresh_at,"%Y-%m-%dT%H:%M:%S.%6NZ") | eval UpdateDate=strftime(evTime,"%Y-%m-%d") | eval UpdateTime=strftime(evTime,"%H:%M:%S.%1N") | table agent.status.policy_refresh_at, evTime, UpdateDate, UpdateTime, hostname ----------------- agent.status.policy_refresh_at evTime UpdateDate UpdateTime          hostname 2024-01-04T10:31:35.529752Z       CN******* 2024-01-04T10:31:51.654448Z       CN******* 2023-11-26T05:57:47.775675Z       gb******** 2024-01-04T10:32:14.416359Z       cn******** 2024-01-04T10:30:32.998086Z       cn******* ... View more

Actually both, Not getting any data is bigger issue. but else it's important to understand the nature (and fix) an issue with client being "unstable" ... View more