index=gbts-vconnection * onEvent DISCONNECTED (host=Host1) | rex field=_raw "(?ms)^(?:[^:\\n]*:){5}(?P<IONS>[^;]+)(?:[^:\\n]*:){8}(?P<Device>[^;]+)(?:[^;\\n]*;){4}\\w+:(?P<VDI>\\w+)" offset_field=_extracted_fields_bounds This lists all Devices that have disconnected.  I'm trying to create a chart that lists only Macs, or Windows based on a key word like "mac" or "laptop"  in the Device name.  I tried using eval command but can't seem to get it working.   ... View more

index=gbts-vconnection sourcetype=VMWareVDM_debug "onEvent: DISCONNECTED" (host=Host1 OR host=host2) | rex field=_raw "(?ms)^(?:[^:\\n]*:){5}(?P<IONS>[^;]+)(?:[^:\\n]*:){8}(?P<Device>[^;]+)(?:[^;\\n]*;){4}\\w+:(?P<VDI>\\w+)" offset_field=_extracted_fields_bounds | eventstats count as failed_count by IONS | where failed_count>=10 | timechart dc(IONS) as IONS span=1d This command does get me the last 24 hours (11/5/23-11/6/23) stats accurately.  However, when I change the time picker to 30 days it shows a very large number for 11/5,11/6 and every day in that 30 day period.  I need the timechart to show only the IONS that have disconnected 10 or more times and show that number daily in a line chart.  I can't seem to get this to work.  Thank you!  ... View more

I was able to find this search that gives me the number of users(IONS) who disconnected 10 or more times however it gives me the total based on time.  I would like to display a daily number for 30 days in a line chart.  For example Monday there were 10 users who disconnected over 10 time and so on for the rest of week. I can't seem to get the timechart to work with this: index=gbts-vconnection sourcetype=VMWareVDM_debug "onEvent: DISCONNECTED" (host=Host1 OR host=host2) | rex field=_raw "(?ms)^(?:[^:\\n]*:){5}(?P<IONS>[^;]+)(?:[^:\\n]*:){8}(?P<Device>[^;]+)(?:[^;\\n]*;){4}\\w+:(?P<VDI>\\w+)" offset_field=_extracted_fields_bounds | stats count by Device IONS | where count >= 10 | appendpipe [|stats count as IONS | eval Device="Total"] ... View more

I can get total disconnects but can't seem to find a way to get total of how may users who disconnected 10 or more times.     Here is my search:   index=gbts-vconnection sourcetype=VMWareVDM_debug "onEvent: DISCONNECTED" (host=host2) OR host=Host1) earliest=$time_tok.earliest$ latest=$time_tok.latest$ | rex field=_raw "(?ms)^(?:[^:\\n]*:){5}(?P<IONS>[^;]+)(?:[^:\\n]*:){8}(?P<Device>[^;]+)(?:[^;\\n]*;){4}\\w+:(?P<VDI>\\w+)" offset_field=_extracted_fields_bounds  | rename IONS as "User ID" Device as "User Device" | convert timeformat="%m-%d-%Y" ctime(_time) AS date |timechart span=1d limit=0 , count   ... View more

Hello!  I'm trying to figure out a way to display a single value that calculates users who have disconnected divided by the time range based on the time picker.   The original number comes from the avg of total disconnects divided by the distinct user count.  I need to divide that number by the number of days which is based on the time picker.  The goal is to get the avg user disconnects per day based on time frame selected in time picker.  For example if there are 100 disconnects and 10 distinct users =10, then divided by the number of days selected in picker(7) should equal 1.42 disconnects per day.  I hope that makes sense.  Here is my search: Index=... Host=HostName  earliest=$time_tok.earliest$ latest=$time_tok.latest$ | stats count by "User ID" |search "User ID"=* |stats avg(count) That will only give me the Total disconnects divided by Distinct users, but I need that number divided by the time picker number of days and I can't get it to work.  Thank you!!!     ... View more