Hello, I need some help. Manipulating time is something I have struggled with  Below is the code I have   ((index="desktop_os") (sourcetype="itsm_remedy")) earliest=-1d@d | search ASSIGNED_GROUP IN ("Desktop_Support_1", "Remote_Support") ``` Convert REPORTED_DATE to epoch form ``` | eval REPORTED_DATE2=strptime(REPORTED_DATE, "%Y-%m-%d %H:%M:%S") ``` Keep events reported more than 12 hours ago so are due in < 12 hours ``` | where REPORTED_DATE2 <= relative_time(now(), "-12h") | eval MTTRSET = round((now()-REPORTED_DATE2)/3600) | dedup INCIDENT_NUMBER | stats values(REPORTED_DATE) AS Reported, values(DESCRIPTION) AS Title, values(ASSIGNED_GROUP) AS Group, values(ASSIGNEE) AS Assignee, LAST(STATUS_TXT) as Status,values(MTTRSET) as MTTRHours, values(STATUS_REASON_TXT) as PendStatus by INCIDENT_NUMBER | search Status IN ("ASSIGNED", "IN PROGRESS", "PENDING") | sort Assignee | table Assignee MTTRHours INCIDENT_NUMBER Reported Title Title Status PendStatus  this code runs and gives us the results we need, but the issue is that REPORTED_DATE field is off by 5 hours due to time zone issue. that is a custom field from out ticketing system that is stuck on GMT and the output looks like  2024-01-08 09:22:49.0 I need to get that field produce a correct timezone for EST. I am struggling with making it work. I looked at this thread but that is not working for us: Solved: How to convert date and time in UTC to EST? - Splunk Community Any help is appreciated.   Thanks   ... View more

Hello, So I am trying to build a report that alerts us when a support ticket is about to hit 24hrs, The filed we are using is custom time field called REPORTED_DATE and it displays the time in the way  2023-09-11 08:44:03.0 I need a report That tells us when tickets are within 12hrs or less of crossing the 24 hour mark.    This is our code so far    ((index="wss_desktop_os") (sourcetype="support_remedy")) earliest=-1d@d | search ASSIGNED_GROUP="DESKTOP_SUPPORT" AND STATUS_TXT IN ("ASSIGNED", "IN PROGRESS", "PENDING") | eval TEST = REPORTED_DATE | eval REPORTED_DATE2=strptime(TEST, "%Y-%m-%d") | eval MTTRSET = round((now() - REPORTED_DATE2) /3600) ```| eval MTTR = strptime(MTTRSET, "%Hh, %M")``` | dedup ENTRY_ID | stats LAST(REPORTED_DATE) AS Reported, values(ASSIGNEE) AS Assignee, values(STATUS_TXT) as Status,values(MTTRSET) as MTTR by ENTRY_ID   Any help would be appreciated. I will admit I struggle with time calucations ... View more

Hello, So am trying to get a report of how many times in a month a certain process runs  on a machine and when the last it did index=wss_desktop_perfmon sourcetype="wks:Perf_Process" instance!="_Total" instance!="idle"  | where instance like "%bplus.wtk%" So this is the start of the search. The process bplus.wtk in splunk can have multiple instances like  bplus.wtk2#1 bplus.wtk2#2 bplus.wtk2#3 I do not care about the info past bplus.wtk I just want a count of how many times that shows up in month on a machine and count it On that machine I want a report that looks like  Computer  bplus.wtk  Last Time it Ran workstation1 100 6/23/2023 workstation2  250 6/27/2023   I have tried Stats count and it is not working because I think it is a string value I am looking at and not a number value.  Any help is appreciated ... View more

Hello, I have field that is called Bootuptime it is displayed like 20230521050657.500000-300 it is not string field and I have used a command like | eval Boot=strptime(Bootuptime, "%Y-%m-%d %H:%M:S"). Which returns nothing or converts it to UNIX. Which does work If you look at the result the part I care about is 20230521050657 which Need to display like  2023-05-21 05:06:57,  there is no converting of numbers, I just need to add the appropriate dashes and colons and remove the part after the period. Any help is appreciated   Thanks   ... View more

Hello, I have a report I have having issues with. It is for CPU Usage on laptops.  I have tried the Stats perc() and the stats avg(). I get a lot of false positives, for insistence if a laptop get powered on for a couple of hours , there would be 8 data points, since the default is pull CPU usage every 15 mins.  So 4 of the data points could be high CPU usage but that is explained but the bootup, patching and other scripts running. What we care about is  is consistent CPU usage. SO we are monitoring the data points and for every data point that goes over 70% CPU then add one to the count Then over a week a we only want to see per machine when have more then 70 data point going over 70%. The change I am having is also want to get total count of data points as well. so we can take the total data points and compare it to the High CPU Data points and get a  percentage of High Processor time   So this is the code I have and it works at telling me the data point over 70%. but when ever I try and play around with al adding a over all total I can not get it to work index=wss_desktop_perfmon sourcetype="wks:Perf_Processor" %_Processor_Time > 69 | stats count as CPULoad avg(%_Processor_Time) as %_Processor_Time by host | lookup local=true PrimaryUsers.csv host AS host OUTPUT host DeviceType FullName Location Address Model OSVer TotalPhysicalMemoryKB Email PrimaryUser Supervisor "Supervisor Email" | search Location IN ("GA1*", "GA7*", "GA9*") | where CPULoad > 70 | rename CPULoad as "High CPU DataPoint" Host High CPU DataPoint %_Processor_Time Computer1 97 78.54106664   Now would like to add in a total count of data points from %_Processor_Time  ... View more

Hello,  I need some help. I have a index where I pull all of the HR info for our employees then I have a CSV I bring in using the LOOKUP command, the CSV has al the of the machine info for each user.  The CSV file has no Multi value fields. So if a user has multiple computers there would be a separate line in the CSV for that. what is happening when I run this code the splunk is creating Multi value field for all the machine info when a person has multiple computers.  I have tried a used MVexpand. But I have to do it on 14 different fields and then I get a Memory error. Which I can not increase the memory we have certain restrictions on that. Even if I do one MVexpand same memory error. the report will produce over 140000 entries. SO below is my basic code. that code will produce the multivalue fields which I do not want. I need the report when i user has multi machines it creates a completely separate line for that. this code does not include the MVexpand. Is there any way to do that without using mvexpand   (index=wss_desktop_os sourcetype="associate"LOGON_ID="*") LOCATION IN ("CA1*", "CA2*", "CA3*", "CA4*", "CA5*", "CA6*") | stats values(SPVR_FLL_NM) AS Supervisor, values(EMP_STA_TX) AS "Employee Status" values(SPVR_EMAIL_AD) AS "Supervisor Email", values(L2_LN1_AD) AS Address, values(L2_CTY_NM) AS City, values(SITE_COUNTRY) AS Country, values(DEPARTMENT) AS Department, values(DIV_LG_NM) AS Division, values(L2_FLR_NO) AS Floor, values(FLL_NM) AS FullName, values(LOCATION) AS Location, values(L2_CNY_CD) AS Region, values(L2_CNY_NM) AS SiteCountry, values(LOB) AS ORG, values(L2_STPV_NM) AS State, values(WRK_EMAIL_AD) AS Email by LOGON_ID | lookup local=true PrimaryUser.csv PrimaryUser AS LOGON_ID OUTPUT host AS host BuildNumber Cores DeviceType InstallDate LastBootUpTime LastReported Locale Manufacturer Model OSVer PCSystemType SerialNumber TotalPhysicalMemoryKB TotalVirtualMemoryKB | where host NOT null     ... View more