About clehw

clehw · ‎05-02-2023

Thanks so much for this! Also fixed my similar issues! 🙂

clehw · ‎03-18-2020

Hello! So i have an alert that emails out a report of productnames, their lifecyclestatus and the PrimaryPO, SecondaryPO and TertiaryPO (Product Owner) I would like to create a token to pass to the "to" field of the email message where lifecyclestatus=newproduct to the PrimaryPO it can either be a batch email to send to multiple primarypo addresses for multiple lifecyclestatus=newproduct or a single email to each seperately... Does anyone have any ideas if this is doable? I hope i have explained that clearly enough. Thanks in advance! Carly Please stay safe and healthy!

clehw · ‎03-12-2020

"Hope that helps!" ok well... my response is WOW! That is above and beyond and the breakdown was super helpful. I'll just clarify the one question you had on notnull. Actually with that I am searching for null in addition to, reason being is I have identified systems that show up in 3 different environments which include macs, windows workstations and servers that do not show up in another environment(epo). So I want them to be considered not compliant. In order to accomplish that I add the machine names in the sql database with their host name, ostype and last seen from the other environments. Once they land in splunkville they will have a null product name. I only do it that way because I am not that experienced with splunk and it seemed the easiest way to get them included without adding another join to another sourcetype. If I'm not mistaken using NOT ProductName="*" includes those hosts that do not contain a productname. The breakdown was terrific and you are so right about efficiency! My search can take a couple minutes to complete while yours takes easily less than a minute and that was hitting on 6M events for 60 days searching over 34M records! Super impressed with the efficiency of the way you do that without the join!!! Thank you so much this was a great answer to the question and educational as well! Carly

clehw · ‎03-12-2020

"Hope that helps!" ok well... my response is WOW! That is above and beyond and the breakdown was super helpful. I'll just clarify the one question you had on notnull. Actually with that I am searching for null in addition to, reason being is I have identified systems that show up in 3 different environments which and include macs, windows workstations and servers that do not show up in another environment(epo). So I want them to be considered not compliant. In order to accomplish that I add the machine names in the sql database with their host name, ostype and last seen from the other environments. Once they land in splunkville they will have a null product name. I only do it that way because I am not that experienced with splunk and it seemed the easiest way to get them included without adding another joint to another sourcetype. If I'm not mistaken using NOT ProductName="*" includes those hosts that do not contain a productname. The breakdown was terrific and let me just say you are so right about efficiency my search can take a couple minutes to complete while yours takes easily less than a minute and that was hitting on 6M events for 60 days searching over 34 records! Super impressed with the efficiency of the way you do that without the join!!! Thanks tons!!!

clehw · ‎03-11-2020

Hello to you as well my former Allstater. 🙂 Yes correct, The sub search does return correct results when run independently and i am looking for the result to yield a line for each compliant and not compliant in the same chart over the 90 day period. note there are asterisks inside the empty quotes... not sure they are showing correctly.

clehw · ‎03-10-2020

I am trying to create a timechart for a query that returns a count for a set of products that where it's lifecycle status is either compliant or our of compliance. the count is then used to create a percentage. The query returns the two counts (which i don't care about) and the associated percentage for each (which is what do want to get into a time chart for the past 90 days. I have the search working but have not been able to figure out how to get the percents (two lines, one chart) into a timechart. Below is my search any help would be appreciated. What i have so far does return a count of events but nothing in a chart and the search itself says no results found index="index" sourcetype=productversion (( removablemedia_win OSType="Windows*" AND LifeCycleStatus!="NewVersion") OR NOT ProductName="") | stats count(LifeCycleStatus) AS lifecycletotal | join type=outer OSType [search index="index" sourcetype=productversion (NOT ProductName="" (OSType="Windows*")) OR ( removablemedia_win AND (OSType="Windows*") AND (LifeCycleStatus="Mainstream" OR LifeCycleStatus="Emerging")) | stats count(LifeCycleStatus) AS IsCompliant] | eval Compliant=(IsCompliant/lifecycletotal)*100 | eval Compliant=round(Compliant,2) | eval NonCompliant=(100-Compliant) | eval NonCompliant=round(NonCompliant,2) | timechart span=1d first(Compliant) as Compliant first(NonCompliant) as NonCompliant

Posts	6
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎01-08-2020

Online Status	Offline
Date Last Visited	‎05-04-2023 12:15 AM

Using tokens in email alerts to define a mailto ad...

Creating a timechart for a query with percentages ...

Re: Separate multi-value field in individual field...

Using tokens in email alerts to define a mailto ad...

Re: Creating a timechart for a query with percenta...

Re: Creating a timechart for a query with percenta...

Re: Creating a timechart for a query with percenta...

Creating a timechart for a query with percentages ...