ALCON, Hello, I am having issues with printmon query results not showing the proper results for "total_pages".  The page_printed is always equal to zero (0). Moreover, total_pages value is also not right as when I print 5 pages it is telling only 1. Any solution to that? One Example Query: (ALL "printmon" Queries give me the same inaccurate results) Index=wineventlog eventtype=printmon_windows (host=”Printer Name” OR host=”Printer Name”) user=”If looking for specific user info” | table _time, user, document, machine, printer, driver_name, total-pages, size_bytes | rename user as “User”, document as “Document”, machine as “Host”, printer as “Location”, driver_name as “Driver”, total_pages as “Total Pages”, size_bytes as “Bytes” | dedup document | sort - _time   Other Links about Subject but old info without any solution or fix: 1. WinPrintMon not logging page_printed correctly (‎24May2015) Link: https://community.splunk.com/t5/Getting-Data-In/WinPrintMon-not-logging-page-printed-correctly/m-p/121725 2. 1winprintmon search results aren't showing the proper results for "total_pages" (20Feb2019 at 0826) Link: https://community.splunk.com/t5/Splunk-Search/winprintmon-search-results-aren-t-showing-the-proper-results-for/m-p/392683#M172918   Please provide example query or where to find the fix. ... View more

I am trying to create an after hour query with specific time frames 1. Mon 0000-0700 and 1900-2400, 2. Tue 0000-0700 and 1900-2400, 3. Wed 0000-0700 and 1900-2400, Thur 0000-0700 and 1900-2400, Fri 0000-0700 and 1900-2400, Sat 0000-2400, and Sun 0000-2400. I have my Cron Express set for 43 10***  | sort - _time | eval user=lower(user) |eval Day=strftime(_time,”%A”) |eval Hour=strftime(_time,”%H”) |eval Date=strftime(_time,”Y-%m-%d”) | search Hour IN (19,20,21,22,23,24,0,1,2,3,4,5,6,7) | table Date, Day, Hour, “User Account” I like the way this is displayed but I cannot figure out how to combine this query with a weekend (FRI 1900-Mon 0700) query. Or will I have to have two different queries? Once completed this will make a good dashboard.  ... View more