The sender and recipient information  I need from Unix/Linux "sendmail" logs is contained in separate lines in the sendmail log.  I am able to correlate all the entries for a given email using nested search, dedup, and transation using the following search:      index="sendmail_logs" host=relay* [search index="sendmail_logs" host=relay* from=\<*@example.com\> | dedup qid | fields qid ] | transaction fields=qid maxspan=1m which produces the following (simplified and obfuscated): 2023-01-26T23:37:25+00:00 relay1 sendmail[115877]: 30QNbOpD115877: milter=ourmiltname, action=mail, continue 2023-01-26T23:37:25+00:00 relay1 sendmail[115877]: 30QNbOpD115877: milter=ourmiltname, action=rcpt, continue 2023-01-26T23:37:25+00:00 relay1 sendmail[115877]: 30QNbOpD115877: milter=ourmiltname, action=data, continue 2023-01-26T23:37:25+00:00 relay1 sendmail[115877]: 30QNbOpD115877: from=<bounce+e1165d.ef30-username=ourdomain.com@example.com>, size=25677, class=0, nrcpts=1, msgid=<20230126233721.b60dfcd8b6c1249b@example.com>, bodytype=8BITMIME, proto=ESMTPS, daemon=MTA, tls_verify=NO, auth=NONE, relay=m194-164.mailgun.net [161.38.194.164] 2023-01-26T23:37:26+00:00 relay1 sendmail[115877]: 30QNbOpD115877: milter add: header: X-NUNYA-SPF-Record: v=spf1 include:mailgun.org include:_spf.smtp.com ~all 2023-01-26T23:37:26+00:00 relay1 sendmail[115877]: 30QNbOpD115877: milter change: header Subject: from Sample Subject Line to EXTERNAL: Sample Subject Line 2023-01-26T23:37:26+00:00 relay1 sendmail[115877]: 30QNbOpD115877: milter=ourmiltname, action=eoh, continue 2023-01-26T23:37:27+00:00 relay1 sendmail[115887]: 30QNbOpD115877: to=<username@ourdomain.com>, delay=00:00:02, xdelay=00:00:01, mailer=smtp, tls_verify=OK, pri=145677, relay=nexthop.ourdomain.com. [192.168.0.7], dsn=2.0.0, stat=Sent (30QNbQau230876 Message accepted for delivery) 2023-01-26T23:37:27+00:00 relay1 sendmail[115887]: 30QNbOpD115877: done; delay=00:00:02, ntries= Now, what I want to do is reduce the output to only the lines that contain the strings "from=" OR "to=".   I am new to splunk, so i tried adding adding           |  regex _raw="from\=\<|to\=\<" but all the lines are still displayed.   Suggestions on how to correct my query?

Hey everyone. I am trying to do a stats count by items{}.description, items{}.price but I'd like to filter out some of the items. In this example, I'd like to include "description one" and "description two", but not "description three".  In the real situation there is many more that I'd like to include and to exclude. Is this possible?       "time": "01:01:01", "items": [ { "description": "description one", "price": "$220" }, { "description": "description two", "price": "$10" }, { "description": "description three", "price": "$50" } ]        

For Cisco I used the filter below, I will need to add filters for whatever view I am looking for. I want to look up the total number of users for a specific day of the month on a host. @ What do I need to add to my filter?   index="its_sslvpn" host=*SIRA* user=*@*   Thank you.  Anthony  

I'm trying to filter out events like the ones below using the regex expression regex _raw!="^[A-Za-z0-9]{4}:.*$"   but its not working.  Can someone help me with this?   Events 0000: 00 025e 28:0a000c5f call 0a000c5f 0000: 04 025d 14 ldnull 007a: 00 021d de:2a leave.s :0000=>01 0249 11:07 ldloc.s 07

Hello Splunkers, Here is my use-case : I am monitoring apache logs on 3 different VMs, one VM for each env : dev, uat, prod I do not see the point to create a specific index for each env (no security / restrictions needed). But I still want to be able to distinguish the logs by environment.  What would be the best practice to do that ? Create a tag / event type ? for each host from where the logs are coming ? Regards, GaetanVP

Hi all, I am new to Spluntk and have problem with my search. I have a Lookup table: Error.csv Filter *Error1* *Error2* *Error3* ... I want to use this Lookup table to filter the raw data from logs.  However the raw data does not exactly match the values from the Lookup but rather includes Error1, Error2 ... I am trying to only show the logs that do not include these specific messages from the Lookup table. My query: basesearch | table _raw, host, source [| inputlookup Error.csv ]| fields Filter| where NOT raw=Filter The query does not show any results and i have been trying to get it to work for hours now, but somehow can not figure out how.