Try this LINE_BREAKER = ([\r\n]+)\{[\s\S]+?event\d SEDCMD-stripStart = s/\{[\s\S]+?"vulnerability":\s\[// SEDCMD-stripEnd = s/\],[\s\S]+?"next": .*// The [\s\S]+? construct usually works best at matching embedded newlines.

Hi, I could get the results when I run the command. My observation about the lookup file  between SH and ES on SH is , the .CSV extension is missing.once added it's running. I'm trying understand the below query to implement. Firstly, the description provided in   the usecase is not clearly understood . I got this usecase from the splunk SF content search. Anyone has idea about this query. https://lantern.splunk.com/Splunk_Platform/UCE/Security/Threat_Hunting/Protecting_a_Salesforce_cloud_deployment/Spike_in_exported_records_from_Salesforce_cloud ROWS_PROCESSED>0 EVENT_TYPE=API OR EVENT_TYPE=BulkAPI OR EVENT_TYPE=RestAPI |lookup lookup_sfdc_usernames USER_ID |bucket _time span=1d |stats sum(ROWS_PROCESSED) AS rows BY _time Username |stats count AS num_data_samples max(eval(if(_time >= relative_time(maxtime, "-1d@d"), 'rows',null))) AS rows avg(eval(if(_time<relative_time(maxtime,"-1d@d"),'rows',null))) AS avg stdev(eval(if(_time<relative_time(maxtime,"-1d@d"),'rows',null))) AS stdev BY Username |eval lowerBound=(avg-stdev*2), upperBound=(avg+stdev*2) |where 'rows' > upperBound AND num_data_samples >=7      

This is an old thread so you may be more likely to get responses from a new question. Have you tried untarring the file rather than using the splunk install command? 7-zip can be used to extract the .spl file to %SPLUNK_HOME%\etc\apps

I had aws:cloudwatch:metrics to get the custom metrics. Is there any way where I can get all the aws cloudwatch log group directly rather mentioning one by one , because when there is new log group created we have to reconfigure it and there chance of forgetting to add new log group

HI @SplunkingKnight  Not sure what I am doing wrong here. I am setting it in local on my app. But I am getting this on a startup.   An the colors are still very bright. I am using this to applay it any help would be great - 

Again - Splunk won't find something that's not there. Because how should it? So you need to have a list of what you expect, then you do a list of what you have and you compare both lists. You can't get it other way because how? If Splunk doesn't have something it can't tell you what it is. See the link I pointed you to. The question is how do you compile that list.  You're saying that you have specific sourcetypes "associated" with indexes. So you should have some table. Upload this table to Splunk as lookup and use this lookup to compare with your search results.