So, I think my problem is actually I only have OpenJDK. I have installed the correct JRE from Oracle (got from here: http://www.oracle.com/technetwork/java/javase/downloads/jre8-downloads-2133155.html) But It will not let me set the JRE Installation Path in the General Settings of DBX. ... View more

Thank you, this is giving me much more to work with. ... View more

Is that the full event? Which part are you trying to extract? What are the names of the fields here? ... View more

You could use either eval or rex to do this. As others have already provided you with the answer for using an eval, a regular expression query would look like this: Base Search | rex field=hosts "(?<location>MMK|RTP).*" The regular expression can be tidied up a bit more if you gave an example of your events. ... View more

First out, chop off the first bit so you are left with this: Your base query |rex field=data_nascimento "(?<birthyear>\d+)-(?<birthmonth>\d+)-(?<birthday>\d+)" | eval bdaythisyear=strptime(strftime(now(),"%Y")."-".tostring(birthmonth)."-".tostring(birthday),"%Y-%m-%d") | eval lastbday=if(bdaythisyear>now(),strptime((tonumber(strftime(now(),"%Y"))-1)."-".tostring(birthmonth)."-".tostring(birthday),"%Y-%m-%d"),strptime(strftime(now(),"%Y")."-".tostring(birthmonth)."-".tostring(birthday),"%Y-%m-%d")) | eval ageyear=tonumber(strftime(lastbday,"%Y"))-birthyear | eval ageday=round((now()-lastbday)/86400) Also you will need to change the regular expression in that part if your birthday format is not YYYY-MM-DD ... View more

Wow, yes this is exactly what I needed. You way is much more clever than my way. thanks! ... View more

This makes the age slightly older than they actually are. If someone is 16 years and 1 day old it will say they are 17. The way I have it is a little more accurate but not nearly as elegant. ... View more

The only way I found to do this was to do a bit of brute force. This way is not 100% accurate but was close enough for what I wanted to do. The first thing I did was split out the year, month, and day of the date of birth and of now(). Yes the regular expression can be tidied: | eval yearOfNow = strftime(now(),"%Y") | eval monthOfNow = strftime(now(), "%m") | eval dayOfNow = strftime(now(), "%d") | rex field=dateofbirth "(?<yearOfBirth>\d{4})" | rex field=dateofbirth "-(?<monthOfBirth>\d{2})-" | rex field=dateofbirth "\d{4}-\d{2}-(?<dayOfBirth>\d{2})" Then assuming none of the dates are before year 0 you can very very roughly work out the number of days between date of birth and now by doing something like this: |eval daysToBirth = (yearOfBirth*365.25) + ((monthOfBirth-1)*30) + (dayOfBirth) |eval daysToToday = (yearOfNow*365.25) + ((monthOfNow-1)*30) + (dayOfNow) |eval yearsOld = (daysToToday-daysToBirth)/365.25 So if you use the example of someone being born on 06/05/1965 and you try to work out their age (from today which is 12/01/2016) you get the following yearOfBirth=1965 monthOfBirth=5 dayOfBirth=6 yearOfNow=2016 monthOfNow=1 dayOfNow=12 daysToBirth=717842.25 daysToNow=736356 Which gives you the number of days between the dates as ROUGHLY 18513.75 Which makes yearsOld=50.687 This example gives you a reasonably accurate answer (the correct answer is actually 18513 days exactly). The inaccuracy is due to the fact I am cheating and saying that each month in a year is 30 days long. ... View more

I never got a super accurate way of doing it. The closest I got was to split out and get the year month and day in separate fields for both the date of birth and now(). Then assuming none of the dates are before year 0 you can very very roughly work out the number of days between date of birth and now by doing something like this: |eval daysToBirth = (yearOfBirth*365.25) + ((monthOfBirth-1)*30) + (dayOfBirth) |eval daysToToday = (yearOfNow*365.25) + ((monthOfNow-1)*30 + (dayOfNow) |eval yearsOld = (daysToToday-daysToBirth)/365.25 So if you use the example of someone being born on 06/05/1965 and you try to work out their age (from today which is 12/01/2016) you get the following yearOfBirth=1965 monthOfBirth=5 dayOfBirth=6 yearOfNow=2016 monthOfNow=1 dayOfNow=12 daysToBirth=717842.25 daysToNow=736356 Which gives you the number of days between the dates as ROUGHLY 18513.75 Which makes yearsOld=50.687 This example gives you a reasonably accurate answer (the correct answer is actually 18513 days exactly). The inaccuracy is due to the fact I am cheating and saying that each month in a year is 30 days long. The reason I have not accepted this as the answer as it is not accurate. It is close enough for what I am doing but I was hoping someone out there as a much cleverer way of doing it instead of my brute force attempt. ... View more

I do not understand what the: (eval((_time - startTime) > 259200)) Is doing in the line: | stats first(_time) AS upgradeTime count(eval((_time - startTime) > 259200)) AS count by sessionID SITE_ID ... View more

What does the sessionID part of this do? ... View more

I dummied up some example sample events. ... View more

This is pretty great. Saving this off. Thanks ... View more

Thanks MuS, that is what I am already doing just thought there might have been a work around for autoregress. Guess not. Thanks for your help ... View more

Ah, I see. Splunk does not like it in that format. It wants it to be like 1442339760.000 Slap in : eval CreatedDate=CreatedDate/1000 So it will look something like this: basesearch| eval CreatedDate=CreatedDate/1000|eval MyTime=strftime(CreatedDate,"%c") ... View more

can you just format them like this: basesearch|eval time=strftime(_time,"%c") This will make the format of the new time field this: The date and time in the current locale's format as defined by the server's operating system. For example, Mon Jul 13 09:30:00 2015 for US English on Linux. Common time formats can be found here: http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Commontimeformatvariables ... View more