I have a string of data and i've created regex to break down that set into different fields. There are date values within it (start_date and end_date) but format is ddmmyyy i.e. 2901012001.How can i convert it into DD-MM-YYYY so Splunk recognises it as a date or can be shown in that date format? Ideally i'd like that to be down on ingestion. I have a props.conf and transforms.conf file for the app this sits in

I have the below string in my error log  {"@odata.context":"https://apistaging.payspace.com/odata/v1.1/11846/$metadata#EmployeePosition/$entity","Message":"Invalid value for field Directly reports to Employee Number.","Details":[{"Message":"Invalid value for field Directly reports to Employee Number."}],"Success":false} I have the code as shown below | makeresults | eval test = "{"@odata.context":"https://apistaging.payspace.com/odata/v1.1/11846/$metadata#EmployeePosition/$entity","Message":"Invalid value for field Directly reports to Employee Number.","Details":[{"Message":"Invalid value for field Directly reports to Employee Number."}],"Success":false}" | rex field=test max_match=0 "(?<test>\w+)" | eval test = mvjoin (test, "-") Now the code works by removing all the wild characters, but throws an error as I have double quotes. So need to know how i can ignore the quotes or replace it and then only need to get the string message which i have made in bold.   

table A table B  I know there are lots of ways to spread the table from table B to table A . Is there ant method to transform table A to table B in Splunk without losing any data? like unite in R, pivot in BQ?  

I have an application that sends logs to Splunk every few seconds. These logs are "snapshots" which provide a static view of the system at the time they were taken/sent to Splunk. I am attempting to get the latest rows from Splunk and present them in a table. Latest rows are determined by _time. In the example below I want to retrieve the two last rows because they have the highest _time value. Any help would be appreciated. _time Name Status 9/28/22 8:14:08.968 PM SPID 1 Queued 9/28/22 8:14:08.968 PM SPID 2 Started 9/28/22 8:14:08.968 PM SPID 3 Failing 9/28/22 8:14:12.968 PM SPID 1 Started 9/28/22 8:14:12.968 PM SPID 2 Started  

Hi,  I have a question related to defining volumes especially the coldvolume in our case.  I want to point the coldvolume to a unique location on network attached storage.  Example we have 3 indexers with the following hostnames idx01 idx02 idx03 say we have a local mount point on every indexer which points to the NAS mynas /mnt/coldvolume -> nfs://mynas Option 1 Can I then define a volume in /etc/system/local/indexes.conf on every indexer.  On idx01: [volume:coldvolume] path = /mnt/coldvolume/idx01/ On idx02 [volume:coldvolume] path = /mnt/coldvolume/idx02/ On idx03 [volume:coldvolume] path = /mnt/coldvolume/idx03/ The indexes that are then distributed to all indexers in this cluster are of the format  [myniceindex] coldPath = volume:coldvolume/myniceindex/colddb Option 2 As an alternative I can also mount to the subfolders on the NAS by modifying /etc/fstab and letting the /mnt/coldvolume point to nfs://mynas/idx{01,02,03} I can then distribute the volume definition to all 3 indexers like this [volume:coldvolume] path = /mnt/coldvolume/ Question: Is option 1 a valid / supported configuration for a Splunk indexer cluster? Question: Or is option 2 the best practice? Regards Rob van de Voort

Hi, I have been able to enter the following data in splunk through key value with the following format:           sourcetype="excel_page_10" mail_sender="jordi@jordilazo.com" mail_recipient="lazo@jordilazo.es" mail_date_ep="1635qqqqwe2160816.0" mail_nummails="1222asdasd.adasdqweqw" mail_level="0@qw....." mail_info="NO" mail_removal="NO" mail_area="Miami" mail_subject="RE: NMXWZFOG< >VSTI" mail_id="XXX-KKKK-NNNN-KNZI" mail_reviewcomment="Comentario:ÑC<AZR=@P""\a"            As can be seen in the image, splunk has been able to correctly classify all the fields and value. However it has created a new field called AZR with the value @P. This is because it has detected an = inside the comment review value and created it. What do I have to modify in the props and transform so that it detects the entire reviewcomment field as 1 single value and includes the symbol =?

Hello everyone,  I was updating our licenses and I am still new to Splunk, so I accidentally deleted the auto_generated_pool. I recreated the pool to match the auto_generated_one, but I would just like to know if I might have broken anything or if there is anyway to get Splunk to generate another auto_generated_pool? I checked our indexers and I performed a few searches and it looks like we are still gathering data. 

Hello All , thanks for the help, my exemple:     logStreamName:  _time message 09bfc06d1ff10cb79/config_Ec2_CECIO_Linux/stdout 9/20/2211:22:23.295 AM allo 09bfc06d1ff10cb79/config_Ec2_CECIO_Linux/stdout 9/20/2211:22:23.295 AM allo1 09bfc06d1ff10cb79/config_Ec2_CECIO_Linux/stdout 9/20/2211:23:23.295 AM Erreur 09bfc06d1ff10cb79/config_Ec2_CECIO_Linux/stdout 9/20/2211:23:24.195 AM allo2 09bfc06d1ff10cb79/config_Ec2_CECIO_Linux/stdout 9/20/2211:23:24.195 AM allo4   I want get this output,  for apply after regex for extract some line around the erreur msg logStreamName: _time ms 09bfc06d1ff10cb79/config_Ec2_CECIO_Linux/stdout 9/20/2211:22:23.295 AM allo  allo1 Error allo2 allo4   if i try that search index="bnc_6261_pr_log_conf" logStreamName="*/i-09bfc06d1ff10cb79/config_Ec2_CECIO_Linux/stdout" | stats count by logStreamName | map maxsearches=20 search=" search index="bnc_6261_pr_log_conf" logStreamName=$logStreamName$ | eval ms=_time + message| stats values(ms) by logStreamName,_time "| transaction logStreamName | rex field=ms "(?<ERROR_MESSAGE>.{0,50}Error.{0,50})" it is not working if I perform the rex on msg, if I try use rex on logStreamName with different search string it is work, i try use transaction command for concact msg. and I create ms variable  for add time to my msg , it force too keep the order of message, it the only whey a found. Please help me.