Is this even possible?! Any help will be appreciated. I need to search for specific text in a Windows host name that is located, by naming convention, after a 4, 5 or 6 character campus site code. The specific text identifies the function of the host (e.g., print server, database server, domain controller, etc.). For example (these host names are simplified to illustrate the problem): 1.)    host=L004PS4bldDC7, the campus site code is “L004” and the function code is “PS” 2.)    host= L0005DB5bldPS, the campus site code is “L0005” and the function code is “DB” 3.)    host=L00006DC6rDB1, the campus site code is “L00006” and the function code is “DC” The data I’m searching through has 200+ campus site codes, each of which can be 4, 5 or 6 characters and each search will return 1000+ events. We are using a lookup to identify the campus site attribute from the host name. Using the same process doesn’t work for the function code. The characters following the function code are determined by the campus site admins and used to identify the physical location of each host on their campus (building name or room number). These physical location codes sometimes contain characters that match a function code required by the naming convention. For instance, if I search for events or metrics from print servers using *PS*, I also get them from non-print servers like host #2 above.

Hello Splunkers,    I wanted to extract  output1 and output6 fields from raw event Example Event1: Message : output,1: The guess/tmp/var/tms/bmp_abcd/apm_salesforce/address_standardplot/serviceinput/AddressStandardiplot_S3_VariousDmsJob_V9_apm_unmatch_AVI-pct-STANDARD_123456789_9912333333-f12f-5cb9-aa10-9d101188ad47.banana.2 file, which contains 456 rows, was written to the standardplot-s3-abc-dev-005 bucket. Example Event 2 Message : output,6: Input 0 consumed 123 records. desired result output1=456 rows output6=123 records Message field is also not auto extracted by Splunk. May need to use |rex field=_raw........ Please Advise  

I need to be able to perform a search in Splunk for a message ID and identify all the users that received it. We currently have a SOAR playbook that uses the Microsoft EWS API, but that has been depreciated. As far as I know, Graph API (the replacement) does not have an end point for a full message trace. Does anyone have a better alternative?