Hi Team, 2023-08-27 10:34:18.285 [INFO ] [Thread-30] TriumphUnbilledProcessor - TRIM.UNBILLED event published to ebnc: [{"status":"SUCCESS","description":"Event saved to database successfully."}]   2023-08-27 07:38:31.688 [INFO ] [Thread-31] TriumphCancelTransferProcessor - TRIM.CNX event published to ebnc: [{"status":"SUCCESS","description":"Event saved to database successfully."}] I want to fetch filenames(bold) from row logs: TRIM.UNBILLED and TRIM.CNX my current query: index="abc"sourcetype =600000304_gg_abs_ipc1 source="/amex/app/gfp-settlement-raw/logs/gfp-settlement-raw.log" "event published to ebnc:" NOT "Utils -" | rex " event published to ebnc: \[\{\"status\":\"(?<status>.*)\",\"description\":\"(?<description>.*)\"\}\]" | eval message="event published to ebnc" | table message status description  

Hi,   I need to extract with rex the two first words of one event but sometimes they are only one word. For example, with these data : command:RESTORE LABELONLY FROM DISK=@P1 command:RESTORE VERIFYONLY FROM DISK = 'i:\toto.sql' command:RESTORE VERIFYONLY FROM DISK = 'i:\tata.sql' command:RESTORE LABELONLY FROM DISK=@P1 command:sp_addlinkedsrvlogin command:RESTORE LABELONLY FROM DISK=@P1 I need to have set the field command with these value from these data : RESTORE LABELONLY RESTORE VERIFYONLY RESTORE VERIFYONLY RESTORE LABELONLY sp_addlinkedsrvlogin RESTORE LABELONLY I will apreciate some help to have the correct syntax for rex. Regards

Hi All, I am relatively new to splunk. I am trying to build a search query and below is the condition of the query- | eval status=if(((src="DB_Rebuild_Indexes_UpdateStats_MDM" OR src="DB_Stop_IndexRebuild_Jobs") AND (JobExecTime>39600 OR message="failed")) OR (src="RetailAutonomyDataSync" AND (JobExecTime>21600 OR message="failed")) OR (src="RetailAutonomyPromotionsDataSync" AND (JobExecTime>4000 OR message="failed")) OR (src="retailautonomyfileage" AND (((Fname="mdmdat" OR Fname="omsdat") AND Age>240) OR (Fname="promodat" AND Age>120))) OR (src="retaillineitemdup" AND Count>0) OR (src="esbmessagecount" AND MsgCount>5),"Down","Up") | stats count count(eval(status="Down")) AS Down latest(_time) as _time BY Device Store src host Chain StoreNum Domain  I am facing problem in line no 4 which is - (src="retailautonomyfileage" AND (((Fname="mdmdat" OR Fname="omsdat") AND Age>240) OR (Fname="promodat" AND Age>120)))It is reading all 3 filenames as one (Fname). The source "retailautonomyfileage has 3 filenames (Fname="mdmdat" , Fname="omsdat", Fname="promodat") and when I do the stats count, not sure why it is counting the sum of all 3  filenames altogether in the output (18 instead of 6)- Output- Device Store src host Chain StoreNum Domain count stp-020sql1 stp0020 DB_Rebuild_Indexes_UpdateStats_MDM stp-020sql1.stp.local stp 20 stp.local 6 stp-020sql1 stp0020 DB_Stop_IndexRebuild_Jobs stp-020sql1.stp.local stp 20 stp.local 6 stp-020sql1 stp0020 RetailAutonomyDataSync stp-020sql1.stp.local stp 20 stp.local 6 stp-020sql1 stp0020 RetailAutonomyPromotionsDataSync stp-020sql1.stp.local stp 20 stp.local 6 stp-020sql1 stp0020 esbmessagecount stp-020sql1.stp.local stp 20 stp.local 6 stp-020sql1 stp0020 retailautonomyfileage stp-020sql1.stp.local stp 20 stp.local 18 stp-020sql1 stp0020 retaillineitemdup stp-020sql1.stp.local stp 20 stp.local 6 stp-089sql1 stp0089 DB_Rebuild_Indexes_UpdateStats_MDM stp-089sql1.stp.local stp 89 stp.local 6 stp-089sql1 stp0089 DB_Stop_IndexRebuild_Jobs stp-089sql1.stp.local stp 89 stp.local 6   I am trying to break it into 3 lines under the search query . eg  (src="retailautonomyfileage1") AND (Fname="mdmdat" AND Age>240))  (src="retailautonomyfileage2" AND (Fname="omsdat" AND Age>240)) (src="retailautonomyfileage3" AND (Fname="promodat" AND Age>120)) Not sure how I can obtain that. Please help.   Thanks in Advance.