May be useful. https://community.splunk.com/t5/Getting-Data-In/Posting-data-to-HTTP-Event-Collector-HEC-without-passing-HEC/td-p/504537 ... View more

 index=xyz | stats count by eventtype | search eventtype IN (“Error”,”Auth”) ... View more

As I mentioned earlier, for date comparisons you have to convert them into epoch. make sure your time formats are in proper format. for example month you mentioned sometime full month name, sometimes abbreviated month, difficult to write query if that is case, hence I have modified them in my below query.   |makeresults | eval test="Phase 1=1 Jan 2020,1 Mar 2020|Phase 2=1 Apr 2020,1 Jun 2020" | makemv test delim="|" | mvexpand test | rex field=test "(?<phase>[^\=]+)\=(?<first_date>[^\,]+)\,(?<last_date>.*)" | eval verified_date="3 Feb 2020" | eval first_date_epoch=strptime(first_date,"%d %b %Y"),last_date_epoch=strptime(last_date,"%d %b %Y"),verified_epoch=strptime(verified_date,"%d %b %Y") | eval output = if( verified_epoch >=first_date_epoch AND verified_epoch<=last_date_epoch,"Phase1","Phase2")     ... View more

1st regex    |makeresults | eval _raw="default_message= <14>shell: cmd by abcd: mkdir test" | rex "cmd by (?<user>[^\:]+): (?<command>[^\s]+)"   2nd regex will combine both and work for 1st and second:   |makeresults | eval test="default_message= <14>shell: cmd by abcd: mkdir test|default_message= <133>clish[1234]: User abcd finished running clish -c from CLI shell" | makemv test delim="|" | mvexpand test | rex field=test "cmd by (?<user1>[^\:]+): (?<command1>[^\s]+)" | rex field=test "User (?<user2>[^\s]+) (?<command2>.*)" | eval user=coalesce(user1,user2),command=coalesce(command1,command2) | table test user command   ... View more

  After Splunk version 8, Splunk is expecting python3 for any TA/app development. if you have already developed your TA using python 3 just use  python.version= python3  in your inputs.conf https://docs.splunk.com/Documentation/Splunk/8.0.5/Admin/Inputsconf   ... View more