Splunk queries

3/15/2016 - 8:19 PM

sourcetype="efs-device-analytics" source=ASE  "component_attributes.App_Version"="6.0.46.11"  product_name="AutodeskDesktopApp"
component_attributes.Update_Name="Update 1 for Autodesk® Revit® Structure 2016 Release 2"
"component_attributes.Event_Name"=New_Update_Report
| stats dc(component_attributes.Device_ID) by component_attributes.Update_Name, component_attributes.Update_ID

Explore User - Zombie

sourcetype="efs-device-analytics" source=ASE  (product_name="Autodesk Home" OR product_name = "AutodeskDesktopApp")
"component_attributes.Update_Name"=*
"component_attributes.Event_Name"!=Installed_Update_Report
"component_attributes.Device_ID"="D14353716B7FE36E35D53CE9E2600FA5AB5ECD455021E8D5EA04B8D73523C5F4&639692792F8E6AF81A16032C0F8EB0F26286BD607D3BD9DED5EC067FF4DFCC86&F45812257863D15D0E0903BF34145D59E38B3F015E0F982CD8EF1936646830CA"
| where NOT LIKE(client_id, "132.188.%.%") 
| table _time, device_time,component_attributes.State, component_attributes.Event_Name, component_attributes.Update_Name

Zombie by Update_Name

sourcetype="efs-device-analytics" source=ASE  "component_attributes.App_Version"="6.0.46.11"  product_name="AutodeskDesktopApp"
component_attributes.Update_Name ="AutoCAD® Plant 3D 2016 64-Bit Extension 1"
"component_attributes.Event_Name"=New_Update_Report
| where NOT LIKE(client_id, "132.188.%.%") |eval tNotified=_time
| dedup component_attributes.Update_Name, component_attributes.Device_ID sortby -_time
|join component_attributes.Update_Name , component_attributes.Device_ID[search sourcetype="efs-device-analytics" source=ASE  
component_attributes.Update_Name ="AutoCAD® Plant 3D 2016 64-Bit Extension 1"
"component_attributes.App_Version"="6.0.46.11"  product_name="AutodeskDesktopApp"
"component_attributes.State"="Installation Successful"
| where NOT LIKE(client_id, "132.188.%.%") | eval tInstalled=_time
| dedup component_attributes.Update_Name, component_attributes.Device_ID sortby -_time
]
| eval tDiff = tInstalled - tNotified
| search tDiff < 0
| table component_attributes.Update_Name, tNotified , tDiff ,component_attributes.Device_ID
| join component_attributes.Device_ID[
search sourcetype="efs-device-analytics" source=ASE  (product_name="Autodesk Home" OR product_name = "AutodeskDesktopApp")
"component_attributes.Event_Name"=Wingman_Launched 
| where NOT LIKE(client_id, "132.188.%.%") 
| dedup component_attributes.Device_ID sortby -_time
| eval tLastNotified=_time
|table tLastNotified, component_attributes.Device_ID
]
| eval notifiedDiff = tNotified - tLastNotified
|eval zombieNotificationDiff= abs(notifiedDiff )/3600.0
| eval zombieType =if(zombieNotificationDiff< 24, "Zombie", "Gone")
| table component_attributes.Update_Name, zombieType ,zombieNotificationDiff, component_attributes.Oxygen_ID,component_attributes.Device_ID

Zombie Stats

sourcetype="efs-device-analytics" source=ASE  "component_attributes.App_Version"="6.0.46.11"  product_name="AutodeskDesktopApp"
  "component_attributes.Event_Name"=New_Update_Report
| where NOT LIKE(client_id, "132.188.%.%") |eval tNotified=_time
| dedup component_attributes.Update_Name, component_attributes.Device_ID sortby -_time
| join component_attributes.Update_Name , component_attributes.Device_ID[search 
  sourcetype="efs-device-analytics" source=ASE  "component_attributes.App_Version"="6.0.46.11"  product_name="AutodeskDesktopApp"
  "component_attributes.State"="Installation Successful"
| where NOT LIKE(client_id, "132.188.%.%") | eval tInstalled=_time
| dedup component_attributes.Update_Name, component_attributes.Device_ID sortby -_time
]
| eval tDiff = tInstalled - tNotified
| search tDiff < 0
| table component_attributes.Update_Name, tNotified , tDiff ,component_attributes.Device_ID
| join component_attributes.Device_ID[
  search sourcetype="efs-device-analytics" source=ASE  "component_attributes.App_Version"="6.0.46.11"  product_name="AutodeskDesktopApp"
| where NOT LIKE(client_id, "132.188.%.%") 
| dedup component_attributes.Device_ID sortby -_time
| eval tLastNotified=_time
|table tLastNotified, component_attributes.Device_ID
]
| eval notifiedDiff = tNotified - tLastNotified
| eval zombieNotificationDiff= abs(notifiedDiff )/3600.0
| eval zombieType =if(zombieNotificationDiff< 48, "Zombie", "Gone")
| table component_attributes.Update_Name, zombieType ,zombieNotificationDiff, component_attributes.Oxygen_ID,component_attributes.Device_ID

Zombie Finder

sourcetype="efs-device-analytics" source=ASE  "component_attributes.App_Version"="6.0.46.11"  product_name="AutodeskDesktopApp"
  "component_attributes.Event_Name"=New_Update_Report
| where NOT LIKE(client_id, "132.188.%.%") |eval tNotified=_time
| dedup component_attributes.Update_Name, component_attributes.Device_ID sortby -_time
| join component_attributes.Update_Name , component_attributes.Device_ID[search 
  sourcetype="efs-device-analytics" source=ASE  "component_attributes.App_Version"="6.0.46.11"  product_name="AutodeskDesktopApp"
  "component_attributes.State"="Installation Successful"
| where NOT LIKE(client_id, "132.188.%.%") | eval tInstalled=_time
| dedup component_attributes.Update_Name, component_attributes.Device_ID sortby -_time
]
| eval tDiff = tInstalled - tNotified
| search tDiff < 0
| table component_attributes.Update_Name, tNotified , tDiff ,component_attributes.Device_ID
| join component_attributes.Device_ID[
  search sourcetype="efs-device-analytics" source=ASE  "component_attributes.App_Version"="6.0.46.11"  product_name="AutodeskDesktopApp"
| where NOT LIKE(client_id, "132.188.%.%") 
| dedup component_attributes.Device_ID sortby -_time
| eval tLastNotified=_time
|table tLastNotified, component_attributes.Device_ID
]
| eval notifiedDiff = tNotified - tLastNotified
| eval zombieNotificationDiff= abs(notifiedDiff )/3600.0
| eval zombieType =if(zombieNotificationDiff< 48, "Zombie", "Gone")
| table component_attributes.Update_Name, zombieType ,zombieNotificationDiff, component_attributes.Oxygen_ID,component_attributes.Device_ID
| stats dc(component_attributes.Device_ID) by component_attributes.Update_Name, zombieType

Feedback

sourcetype="efs-device-analytics" source=ASE  (product_name="Autodesk Home" OR product_name = "AutodeskDesktopApp")
"component_attributes.Event_Name"="User_Feedback_Sent" 
| where NOT LIKE(client_id, "132.188.%.%")
| eval myTime = substr(device_time, 1,10)
| bin _time span=1d 
| Table myTime, component_attributes.Oxygen_ID, component_attributes.Feedback, component_attributes.Device_ID

Cacher is the code snippet organizer for pro developers

We empower you and your team to get more done, faster

Splunk queries