Morning, everyone, Thank you in advance for your help. I would like to remove a part of a character from my results. My query results look like this: j2874a8B$ I'd like to delete the $ to get it: j2874a8B How do I proceed? Thank you very much.

this is similar to https://community.splunk.com/t5/Splunk-Search/Merging-with-similar-strings-without-eval/m-p/484972 It works perfect if the difference is at the end of the strings. But I do have some additional strings that are slightly different in the middle. My Current Query Base search | eval Error=message | rex mode=sed "s/(?m)^\s+//g" | rex field=Error mode=sed "s/^((?<Msg>.+)\s)\S+/\1*/" | top 25 Error,file_line,level by build | table build level count file_line Error Error String Example 1:  No exception occurred when displaying value for task=inspect entity.name=software propertyKey=keyNameForSomething. Please write a rule * No exception occurred when displaying value for task=inspect entity.name=software propertyKey=keyNameForSomethingElse. Please write a rule * No exception occurred when displaying value for task=inspect entity.name=software propertyKey=keyNameForSomethingElseElse. Please write a rule *   Error String Example 2 Locale is null for the language, es with ec, com.EditingContext@1y3y1u3e. Skip this * Locale is null for the language, en with ec, com.ITEditingContext@2y5f3u3e. Skip this *   ---  I would hope my output to be the following or similar:  Count,  Error 3, No exception occurred when displaying value for task=inspect entity.name=software propertyKey=*. Please write a rule * 2, Locale is null for the language, *  

Hi I want to install Nmon but can't figureout how . NMON Performance Monitor for Unix and Linux Systems | Splunkbase   this is simple senario: 1-splunk server 192.168.1.1 (Nmon already installed) 2-linux server 192.168.1.2 (forwarder already installed)   AFAIK i shoud extract Nmon in this path /opt/splunkforwarder/etc/apps/ on 192.168.1.2 Nmon Performance for Splunk - Quick clients deployment demo - YouTube put can't find Nmon linux agent.   Any idea? Thanks,  

ORG Month KPI_1 KPI_2 KPI_3 KPI_4 first Sep21 100 NA NA NA first Sep21 NA 100 NA NA first Sep21 NA NA 100 NA first Sep21 NA NA NA 100 how do i convert the table above  to get  the table below: ORG Month KPI_1 KPI_2 KPI_3 KPI_4 first Sep21 100 100 100 100

Hi, I wrote below query which gives me data per service per min... index=**** | bucket _time span=1m | convert ctime(_time) AS Hour timeformat="%H:%M" | stats count AS Requests by service, Hour Below is the screenshot for same   the requests i wanted to split based on HTTP status code (200, 404, 302, 500 etc). I am using below query for same but i am unabe to get the data. index=*** | bucket _time span=1m | convert ctime(_time) AS Hour timeformat="%H:%M" | chart count AS Requests,status as HTTP_status by service, Hour error screen shot -    Can someone please help me how to get the number of requests by status code? Thanks, SG  

Hi all, I am looking for an automated way to export reports on a recurring schedule and to a location other than the the default where the outputscsv command saves them to. I found a few older questions and answers posted but I wanted to see if there was an updated answer to this. Thanks splunkers!