The documentation about the use of tokens talks about using them in emails. Can they be used in other alert integrations such as Moogsoft? ... View more

Ah! Looks like it was fixed in 2008 R2. So now there are 2 different timestamp formats in the logs. e.g. Message=The system time has changed to ?2015?-?12?-?13T13:28:07.492000000Z from ?2015?-?12?-?13T13:18:04.893874600Z. and Message=The system time has changed to 2015-12-12T09:09:14.198Z from 2015-12-12T09:09:14.198Z. So here is my fixed rex (only to the second - decided not to bother with milliseconds): .*to\D+(?<StartYear>\d+)\D+(?<StartMonth>\d+)\D+(?<StartDay>\d+)T(?<StartTime>[^.]+).* from\D+(?<EndYear>\d+)\D+(?<EndMonth>\d+)\D+(?<EndDay>\d+)T(?<EndTime>[^.]+) Here is the full search: source="WinEventLog:System" "system time has changed" | rex field=Message ".*to\D+(?<StartYear>\d+)\D+(?<StartMonth>\d+)\D+(?<StartDay>\d+)T(?<StartTime>[^.]+).* from\D+(?<EndYear>\d+)\D+(?<EndMonth>\d+)\D+(?<EndDay>\d+)T(?<EndTime>[^.]+)" | strcat StartYear "-" StartMonth "-" StartDay "T" StartTime StartTime | strcat EndYear "-" EndMonth "-" EndDay "T" EndTime EndTime | eval StartUnix=strptime(StartTime, "%Y-%m-%dT%H:%M:%S") | eval EndUnix=strptime(EndTime, "%Y-%m-%dT%H:%M:%S") | eval TotalTime=EndUnix - StartUnix | table _time host StartTime EndTime TotalTime ... View more

I'm not quite sure what you're looking for in a graph, but here's a stab in the dark: SourceName=EventLog EventCode=6005 OR EventCode=6006 | eval upordown = if(EventCode=6005, -1, 1) | streamstats sum(upordown) as pcCount | timechart avg(pcCount) This basically treats each event as either a +1 or a -1, and tots up the running total before charting it. Experiment with sorting the data either way before the streamstats , depending on what you want to see you'll get weird-looking results one way or the other. Another way to approach this is using transaction | concurrency : SourceName=EventLog EventCode=6005 OR EventCode=6006 | transaction host startswith=6005 endswith=6006 | concurrency duration = duration | timechart avg(concurrency) as pcCount Try both and see what you like more. ... View more

Can you try doing this and see if it helps index=yourindex sourcetype=yoursourcetype _time="1346149418" | head 999999 | delete ... View more

I agree if we switch to syslog then that would have kept us independent but the splunk feed includes failover, buffering in case of network disconnect and fast reconfig of the agents with the deployment host. Depends if you can make a case for your IT budget and management priorities really. I could have set syslogs to forward direct to zenoss but we're hoping for a budget for something better later on. ... View more