Great, i will download and take a look - cheers 🙂 ... View more

hi I have the same issues, did you get a fix for this? ... View more

hi I have the same issues, did you get a simple soution? ... View more

Hi - I have done this now: FYI this option was not available to be 30 minutes ago. His answer has been moved into an answer and not a comment off an answer. But its all fixed now, so cheers for your help 🙂 ... View more

for some reason i cant do more - > convert to answer! ... View more

Unless he re-posts as an answer then i will accept perhaps ? Im easy, he saved me a lot of work so i defo want to say thanks 🙂 ... View more

I was trying to accept his comment, but i cant as its a commend on an answer. SO i will upvote no worries, but how do i accept his answer ? ... View more

This worked in the end - Thanks 🙂 <condition match="value != &quot;Add new project&quot;"> I have no idea why my Orginal code stopped working, but this is doing the trick. Cheers 🙂 ... View more

Hi - Just getting to this NOW. Looks like this is it. Thanks very much ... View more

Hi Thanks for the answer. Sorry to say, i am still seeing these characters non non alpha-numeric I also had to add in some lines as well as i need to grab out Fields 1st try [MX_TIMING] SHOULD_LINEMERGE =false LINE_BREAKER = ([\r\n]+)(?=\d+\|\d+\:\d+) TIME_PREFIX = ^ TIME_FORMAT = %Y%m%d|%H:%M:%S MAX_TIMESTAMP_LOOKAHEAD = 17 REPORT-MX-TIMING = REPORT-MX-TIMING2 EXTRACT-MX-TIMING = ^(?:[^\|\n]*\|){6} *-*(?P\d+\.\d+)\w+\| *-*(?P\d+\.\d+)s\| *-*(?P\d+)%\| *-*(?P\d+\.\d+)s\| *-*(?P\d+)%\s+\| EXTRACT-MX-TIMING-Memory = \| *(?P\d+\.\d+)Mb*$ SEDCMD-removejunk = s/^(([^\|]+\|){5})([A-z]+)[^A-Z]*([A-z]+\s+\|)/\1\3\4/ 2nd try [MX_TIMING] SHOULD_LINEMERGE =false LINE_BREAKER = ([\r\n]+)(?=\d+\|\d+\:\d+) TIME_PREFIX = ^ TIME_FORMAT = %Y%m%d|%H:%M:%S MAX_TIMESTAMP_LOOKAHEAD = 17 SEDCMD-removejunk = s/^(([^\|]+\|){5})([A-z]+)[^A-Z]*([A-z]+\s+\|)/\1\3\4/ REPORT-MX-TIMING = REPORT-MX-TIMING2 EXTRACT-MX-TIMING = ^(?:[^\|\n]*\|){6} *-*(?P\d+\.\d+)\w+\| *-*(?P\d+\.\d+)s\| *-*(?P\d+)%\| *-*(?P\d+\.\d+)s\| *-*(?P\d+)%\s+\| EXTRACT-MX-TIMING-Memory = \| *(?P\d+\.\d+)Mb*$ This is the transform [REPORT-MX-TIMING2] DELIMS = "|" FIELDS = "Date","Time","UserName","ID","Context","Command" ... View more

However if AS was not possible i would BEFORE would work as well. Cheers again ... View more

Hi Ideally i want to do it AS it is been indexed. This was i can also view _raw if i need to.. Cheers ... View more

Hi Thanks again 🙂 The issues with above is only a sample set, i will have millions of lines of data. All whit different lines and different patterns. I need a generic way to strip non-alphanumeric for example Imput ABC.$%$123....///...///ABC Output ABC123ABC ... View more

Hi Thanks for you help on this. Below is a sample set of the data i have 20151029|12:31:00|MUREXFO | 1 |**SessionCreate** |**MXDIS..&PATCHER** | 0.21s| 0.22s|100%| -0.01s| 0% | |1065.44Mb 20151029|12:31:00|MUREXFO | 2 |**RequestDocument3** |**MXD~'##ISPATCHER** | 0.01s| 0.03s|100%| -0.02s| 0% | |1065.65Mb 20151029|12:31:00|MUREXFO | 3 |**RequestDocument3** |**MXDISP..??ATCHER** | 0.01s| 0.01s|100%| 0.00s| 0% | I am able to pull out the data between the pipes, this is fine 🙂 . I have created a transform. The issues in the case of pipe 5(SessionCreate) and 6(MXDIS..&PATCHER) there can be non- A-to-Z or non 0-9. So i have MXDIS..&PATCHER i want MXDISPATCHER I am looking to remove these This is what i have initially MXDIS..&PATCHER MXD~'##ISPATCHER MXDISP..??ATCHER This is what i want MXDISPATCHER MXDSPATCHER MXDISPATCHER I have tried your suggestion, but i am still getting non- A-Z and non 0-9 [MX_TIMING] DATETIME_CONFIG = NO_BINARY_CHECK = true category = Custom description = MX_TIMING disabled = false pulldown_type = true REPORT-MX-TIMING = REPORT-MX-TIMING2 SEDCMD-remove_not_alpha = s/&|#\\|//g The transform i have is [REPORT-MX-TIMING2] DELIMS = "|" FIELDS = "Date","Time","UserName","ID","Context","Command" Cheers ... View more

Hi I have the following, what i am looking a way is to imporve my regex, if that is possible to take out the non alpha-numeric up till a pipe [MX_TIMING] DATETIME_CONFIG = NO_BINARY_CHECK = true category = Custom description = MX_TIMING disabled = false pulldown_type = true REPORT-MX-TIMING = REPORT-MX-TIMING2 EXTRACT-MX-TIMING = ^(?:[^\|\n]*\|){6} *-*(?P<Elapsed>\d+\.\d+)\w+\| *-*(?P<CPU>\d+\.\d+)s\| *-*(?P<CPU_PER>\d+)%\| *-*(?P<RDB_COM>\d+\.\d+)s\| *-*(?P<RDB_COM_PER>\d+)%\s+\| EXTRACT-MX-TIMING-Memory = \| *(?P<Memory>\d+\.\d+)Mb*$ ... View more

This worked, thanks :). However i have another issues where i am trying to do the same thing in props.conf However i cant seem to get the REG to work (?P<Elapsed>\w+)| The idea is to change the Data at the initial point. any help would be great 🙂 So the data is 20151029|12:31:00|MUREXFO | 1 |SessionCreate |MXDIS..&PATCHER | 0.21s| 0.22s|100%| -0.01s| 0% | |1065.44Mb 20151029|12:31:00|MUREXFO | 2 |RequestDocument3 |MXD~'##ISPATCHER | 0.01s| 0.03s|100%| -0.02s| 0% | |1065.65Mb 20151029|12:31:00|MUREXFO | 3 |RequestDocument3 |MXDISP..??ATCHER | 0.01s| 0.01s|100%| 0.00s| 0% | The code i have is ^(?:[^\|\n]*\|){5}(?P<Command>\w+)| *-*(?P<Elapsed2>\d+\.\d+)\w+\| *-*(?P<CPU>\d+\.\d+)s\| *-*(?P<CPU_PER>\d+)%\| *-*(?P<RDB_COM>\d+\.\d+)s\| *-*(?P<RDB_COM_PER>\d+)%\s+\| The issues is i am only getting the first few characters, and i want all alpha-numeric the pipe | So i have MXDIS..&PATCHER MXD~'##ISPATCHER MXDISP..??ATCHER I want MXDISPATCHER MXDISPATCHER MXDISPATCHER ... View more

Thanks for your help In Datamodels, i am trying to change the data i am reading in to have only alphanumeric What i have peter hi ex⁢ field=1;like& name john What i want peterhi exit field1like name john so i have been trying the following and it working for one, but i want one command for all non alphanumeric. replace(Context,";","") replace(Context,"=","") replace(Context," ","") replace(Context,"&","") ... View more

is there anyway to replace all non alphanumeric with a value? ... View more

Cheers - this is what i needed 🙂 ... View more

in fact it does not work [monitor:///net/dell425srv/dell425srv/apps/SPLUNK_BACK_UP_LIVE/MXTIMING_MEDIUM3/.../.log] i had to use [monitor:///net/dell425srv/dell425srv/apps/SPLUNK_BACK_UP_LIVE/MXTIMING_MEDIUM3.../.log] to get it to work correctly. ... View more

Cheers, I had the $row.Context$ but i did not have the form part. This was it. thanks 🙂 ... View more