Hey everyone. Need some help breaking a json event that is ingested in the current nested json format: [ { "title": "Bad Stuff", "count": 2, "matches": [ { "EventID": 13, "EventRecordID": 19700, "User": "NT AUTHORITY\\SYSTEM" }, { "EventID": 16, "EventRecordID": 21700, "User": "NT AUTHORITY\\ADMIN" } ] }, { "title": "Next Bad Stuff", "count": 2, "matches": [ { "EventID": 14, "EventRecordID": 19700, "User": "NT AUTHORITY\\SYSTEM" }, { "EventID": 17, "EventRecordID": 21700, "User": "NT AUTHORITY\\ADMIN" } ] } ]   Would like to break it into seperate events like this: { "title": "Bad Stuff", "count": 2, "EventID": 13, "EventRecordID": 19700, "User": "NT AUTHORITY\\SYSTEM" } { "title": "Bad Stuff", "count": 2, "EventID": 16, "EventRecordID": 21700, "User": "NT AUTHORITY\\ADMIN" } { "title": "Next Bad Stuff", "count": 2, "EventID": 14, "EventRecordID": 19700, "User": "NT AUTHORITY\\SYSTEM" } { "title": "Next Bad Stuff", "count": 2, "EventID": 17, "EventRecordID": 21700, "User": "NT AUTHORITY\\ADMIN" }   What would I need in my props.conf and transforms.conf to achieve this ?   Thanks in advanced splunk community ! Cheers.

Hi,  I am creating a Dashboard panel via XML Classic method.  My query is quite straightforward as shown below. Issue is,  the panel is displaying all the results despite my xml code having count set to 5 ? Any idea why is it doing so and how to make Splunk limit results as per the count ? <title>Top 5 Countries Last 24 hours</title> <table> <search> <query>index=aws sourcetype="aws:waf" "httpRequest.country"!="-" | stats count by httpRequest.country </query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="count">5</option> <option name="drilldown">none</option> <option name="refresh.display">progressbar</option> </table> Result    

I have to prepare reporting dashboards in Splunk for which I used this query until now:   field1=GTIN_RECEIVED field2=NREC field3=*1234* field4=SNS NOT [search field1=MESSAGE_INVALID OR field1=GTIN_INVALID field2=NREC OR field2=PRODUCER field3=*1234* field4=SNS | dedup field5 | fields field5 ] | dedup field5 | table field5 | rename field5 as gtin   The data size is huge now and the query takes too long to run which is becoming very difficult for me to generate dashboard.   Can someone pls help and simplify this query so that it takes minimal time.

I ran this search on splunk cloud web and I got the results below. Can anyone help on how to resolve   index=_internal source=*/splunkforwarder/var/log/splunk/splunkd.log OR source=*SplunkUniversalForwarder\\var\\log\\splunk\\splunkd.log log_level=ERROR | transaction host component   1) 04-26-2022 13:27:26.944 -0700 ERROR ExecProcessor [4000 ExecProcessor] - message from ""c:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" WinEventCommonChannel - EvtDC::connectToDC: DsBind failed: (1722) 04-26-2022 13:27:26.944 -0700 ERROR ExecProcessor [4000 ExecProcessor] - message from ""c:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" splunk-winevtlog - WinEventLogChannel::init: Failed to bind to DC, dc_bind_time=1031 msec 04-26-2022 13:27:27.959 -0700 ERROR ExecProcessor [4000 ExecProcessor] - message from ""c:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" WinEventCommonChannel - EvtDC::connectToDC: DsBind failed: (1722) 04-26-2022 13:27:29.090 -0700 ERROR ExecProcessor [4000 ExecProcessor] - message from ""c:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" WinEventCommonChannel - EvtDC::connectToDC: DsBind failed: (1722) 04-26-2022 13:27:29.715 -0700 ERROR ExecProcessor [4000 ExecProcessor] - message from ""c:\Program Files\SplunkUniversalForwarder\bin\splunk-winevtlog.exe"" WinEventCommonChannel - EvtDC::connectToDC: DsBind failed: (1722)   2) 04-26-2022 09:38:13.402 -0700 ERROR TcpOutputFd [5228 TcpOutEloop] - Connection to host=1*******0.146:9997 failed 04-26-2022 09:38:43.312 -0700 ERROR TcpOutputFd [5228 TcpOutEloop] - Connection to host=1*******0.146:9997 failed 04-26-2022 09:39:13.173 -0700 ERROR TcpOutputFd [5228 TcpOutEloop] - Connection to host=1*******0.146:9997 failed 04-26-2022 09:39:43.118 -0700 ERROR TcpOutputFd [5228 TcpOutEloop] - Connection to host=1*******0.146:9997 failed 04-26-2022 09:40:12.952 -0700 ERROR TcpOutputFd [5228 TcpOutEloop] - Connection to host=1*******0.146:9997 failed 3) 04-26-2022 08:27:54.691 -0700 ERROR PipelineComponent [6004 CallbackRunnerThread] - Monotonic time source didn't increase; is it stuck?

I'm new to regex and having trouble extracting some text. My raw data is in the following format: ID=[12839829389-8b7e89opf][2839128391DJ33838PR] I need to extract the text between the first two brackets,12839829389-8b7e89opf, into a new field.    So far what I have does not work: | rex field=_raw "ID=[(?<id>.*)]" If anyone could help it would be greatly appreciated.

In short, I have a router with an IP address on a virtual machine, and I need that when I receive a log that one of its interfaces has turned off, a trigger is triggered and my script runs. test1.py from netmiko import ConnectHandler R1 = { "device_type": "cisco_ios", "host": "R1", "ip": "192.168.12.130", "username": "admin", "password": "admin1" } def main(): commands = ['int fa3/0', 'no sh' ] connect = ConnectHandler(**R1) connect.enable() output = connect.send_config_set(commands) print(f"\n\n-------------- Device {R1['ip']} --------------") print(output) print("-------------------- End -------------------") if __name__ == '__main__': main()   Login to splunk I get, the Add to Triggered Alerts trigger is triggered. But the .py file itself does not run. Checked through ".../splunk.exe cmd python .../test1.py " it starts and works. alert_actions.conf [test1] is_custom = 1 label = Change_interface_state description = Change_interface_state icon_path = test1.png alert.execute.cmd = test1.py app.conf [install] is_configured = 1 state = enabled [ui] is_visible = 1 label = test [launcher] author = QAZxsw description = This is custom version = 1.0.0   test1.html <from class="from-horizontal from-complex"> <p>Change state of interface</p> </from>     Help (._.)