Hi , Need some help to extract regular expressions. I have a set of unstructured logs . Part of the log is as shown below: "RequestUTCDateTime":"2022-07-25T11:19:29.0106873Z"}  How would one extract 2022-07-25T11:19:29.0106873Z   and assign it to field RequestUTCDateTime, . This should be done whenever "RequestUTCDateTime" is encountered in the raw log.   Please help me.   Thank You, Ranjitha N  

Hi, I've created this rather complicated piece of SPL. To make it a bit more understandable I added some comment lines. In the screenshot you can see the SPL syntax highlighting stops working correctly from line #20. The strange thing is that when I remove line 20 all together it works fine, and there are more comment lines further on. Whatever comment I put on that position causes this behaviour.  Line removed, it works fine: Comment ```test comment``` breaks the thing down again.  It's just a minor cosmetic thing, but I'd like to know what's happening here and why. We're using splunk Enterprise 8.1.10.1 on my site. Any thoughts appreciated!            

Hi All, I have logs like below and want to create a table out of it.   log1: "connector": { "state": "RUNNING", }, "tasks": [ { "id": 0, "state": "RUNNING", } ], "type": "sink" } GROUP TOPIC PARTITION CURRENT-OFFSET LOG-END-OFFSET LAG CONSUMER-ID HOST CLIENT-ID connect-ABC ABC.sinkevents 0 15087148 15087148 0 connector-consumer-ABC /10.231.95.96 connector-consumer-ABC.sinkevents-0 log2: "connector": { "state": "RUNNING", }, "tasks": [ { "id": 0, "state": "FAILED", } ], "type": "sink" } GROUP TOPIC PARTITION CURRENT-OFFSET LOG-END-OFFSET LAG CONSUMER-ID HOST CLIENT-ID connect-XYZ XYZ.cardtransactionauthorizationalertsent 0 27775 27780 5 connector-consumer-XYZ /10.231.95.97 connector-consumer-XYZ.Cardtransactionauthorizationalertsent-0 connect-XYZ XYZ.cardtransactionauthorizationalertsent 1 27740 27747 7 connector-consumer-XYZ /10.231.95.97 connector-consumer-XYZ.Cardtransactionauthorizationalertsent-0 connect-XYZ XYZ.cardtransactionauthorizationalertsent 2 27836 27836 0 connector-consumer-XYZ /10.231.95.97 connector-consumer-XYZ.Cardtransactionauthorizationalertsent-0   I created the query which give the below table:   .... | rex field=_raw "CLIENT\-ID\s+(?P<Group>[^\s]+)\s(?P<Topic>[^\s]+)\s(?P<Partition>[^\s]+)\s+(?P<Current_Offset>[^\s]+)\s+(?P<Log_End_Offset>[^\s]+)\s+(?P<Lag>[^\s]+)\s+(?P<Consumer_ID>[^\s]+)\s{0,20}(?P<Host>[^\s]+)\s+(?P<Client_ID>[^\s]+)" | table Group,Topic,Partition,Lag,Consumer_ID   Group Topic Partition Lag Consumer_ID connect-ABC ABC.sinkevents 0 0 connector-consumer-ABC connect-XYZ XYZ.cardtransactionauthorizationalertsent 0 5 connector-consumer-XYZ Here I am missing the last 2 lines of log2.  I want to modify the query in a way that it produces the table in below manner: Group Topic Partition Lag Consumer_ID connect-ABC ABC.sinkevents 0 0 connector-consumer-ABC connect-XYZ XYZ.cardtransactionauthorizationalertsent 0 5 connector-consumer-XYZ connect-XYZ XYZ.cardtransactionauthorizationalertsent 1 7 connector-consumer-XYZ connect-XYZ XYZ.cardtransactionauthorizationalertsent 2 0 connector-consumer-XYZ Please help me to modify the query in a way to get my desired output. Your kind help on this is highly appreciated. Thank You..!!

Hello Splunkers !!! I am new to splunk and I am using splunk enterprises in AWS environment and want to fetch logs of few tables from SQL server, for that i have installed Splunk DB Connect . My question is what do i need to put in the below: Configurations > Settings >JRE Installation Path(JAVA_HOME)   if we are using splunk enterprises in the AWS environment, shall we use the JRE path of our local machine , i mean laptop on which we are working else we have use JRE path of aws environment.??  

Greetings,   I have a working Splunk Free running on Ubuntu.   This is Splunk Free for home lab setup.   Connected two Syslog servers + Apps via API (Local Inputs)   My question is how to ensure Splunk Free to free disk space and limit ingested data to below the limit >500 MB for those syslogs + apps   For example if one of the syslog keeps sending data that would have its own limit and Splunk to delete older data to allow new data gets ingested into Splunk to make sure that the 500 MB won't be triggered?    

Hi, I have installed a Splunk instance that serves as a search head and now I need to install another instance to serves as a heavy forwarder. However when I download the Splunk file and extract it on a different directory than my first instance it tells me that port 8000 is being used and then it asks me to give it different ports since other daemon ports are being used as well. Is this normal? Is this the standard procedure to do this? I just need both instances to be running on port 8000 on the same VM. Also I need to ssh into my search head instance however when I run ssh [hostname]@[private-ip:8000] I get an error saying "could not resolve hostname". I would really appreciate some guidance. Thanks.

Hi, Is it possible to Make a table like in the example below, that would refresh every 10 minutes and update the status column to either Arrived or Delayed status and change the color of that row to either green or red.  

Hello everyone With some embarrassment I confess that I do not know how to use the lookup command and although I have read the documentation I have not been able to. I have an index called antivirus and one of the fields is "application" from which I have obtained a list of all the programs installed on the users' computers. Now my client has returned a response with the list of programs that are authorized and I must add an exception to them.   this is the SPL code that I currently use index=antivirus event=KLNAG_EV_INV_APP_INSTALLED |search Aplicacion!="*teams*" Aplicacion!="*Adobe*" Aplicacion!="*java*" Aplicacion!="*skype*" Aplicacion!="*365*" Aplicacion!="*kaspersky*" Aplicacion!="*chrome*" Aplicacion!="*SAP*" Aplicacion!="*SQL*" Aplicacion!="*visual studio*" Aplicacion!="*office*" Aplicacion!="*Microsoft OneDrive*" Aplicacion!="Microsoft Edge" Aplicacion!="WebView2 Runtime de Microsoft Edge" Aplicacion!="zoom" Aplicacion!="Hyland Unity Client [Unity_Prod]" Aplicacion!="Microsoft Windows QFE" Aplicacion!="Offimizer" (here i need use lookup command) | stats count by Aplicacion IP message |sort - count   now, I know that I have the lookup editor plugin, I suppose that from there I can upload the file, my question is if it can be in .xlsx or if it has to be .csv   and 100 more