Rex problem

[henderz]

Hey
I'm trying to extract the values from _time to new fields (Year, Month, Day), in order to compare average of events during current month to last 3 months, but it seems like they do not get any value.

here is my search:

 'soc_events'
    | search * Rule_Name="*"
    | eval mytime=strftime(_time, "%Y/%m/%d") 
    | rex field=mytime "(\"?<Year>\d+)/(?<Month\d+)/(?<Day>\d+)\""
    | stats count as Count by Year,Month,Day
    | sort Year,Month,Day
    | eventstats last(Month) as Current_Month last(Year) as Current_Year 
    | where Month!=CurrentMonth OR Year!=Current_Year
    | stats avg(Count) as DayAveravge values(Month) as Months by Day

[richgalloway]

The regular expression does not match the data. Since the 'mytime' field does not contain quotation marks, they should not be in the rex command. Try | rex field=mytime "(?<Year>\d+)/(?<Month>\d+)/(?<Day>\d+)".

That's not all. Once you filter out all events from the current year using | where Month!=CurrentMonth OR Year!=Current_Year you're likely to have nothing left.

What problem is this query trying to solve?

[henderz]

well as i said i'm trying compare average of events during current month to last 3 months

i did few changes that helped a little :

 'soc_events'
     | search * Rule_Name="*"
     | eval mytime=strftime(_time, "%Y/%m/%d") 
     | rex field=mytime "("?<Year>\d+)/(?<Month\d+)/(?<Day>\d+)""
     | stats count as Count by Year,Month,Day
     | sort Year,Month,Day
     | eventstats last(Month) as Current_Month last(Year) as Current_Year 
     | where Month!=Current_Month OR Year!=Current_Year
     | stats avg(Count) as DayAveravge values(Month) as Months by Day

but now the query does not compare the previous months to this one like i wanted it to

[richgalloway]

I don't see the differences in the latest query.

The events of the last 3 months will all have Year==2020 and Current_Year==2020. Therefore, they will all fail where Year!=Current_Year and will not be displayed.