You can try either of these: (?i)Serial Number:\s\"(?P<cert_sn>\w+)\" OR (?i)Serial Number:\s\"(?P<cert_sn>\w+) --> EDIT: In case you need to capture empty fields then try this: (?i)Serial Number:\s\"(?P<cert_sn>[^\"]*)\" This will capture everything between "" even when there are no spaces between quotes. If you know for certain that there will be spaces between quotes then change * to + . Hope this helps. > please upvote and accept answer if you find it useful - thanks! ... View more

Best recommended method is to persist your data to disk and then have a Forwarder monitor it. Sending it via Syslog may be prone to errors due network problems and/or when an Indexer is down, for whatever reason, including maintenance. Forwarders will keep track of what has been sent for indexing, something that syslog or any other network forwarding methods are not capable of (this, among other things, reduces the risk of having duplicate data in your indexes). Hope this helps. > please upvote and accept answer if you find it useful - thanks! ... View more

The best you can do given your requirement of not knowing the fields ahead of time is: ... | stats count(*) | transpose This will give you a count of ALL fields present in the search. Hope this helps. > please upvote and accept answer if you find it useful - thanks! ... View more

OK, in that case then try something like this using your transforms stanza: transforms.conf [sessiondata] REGEX = ([^\|]+):\s([^\|]+) FORMAT = $1::$2 REGEX reads "anything that is not a pipe, followed by a colon, followed by a space, followed by a pipe, followed by anything that is not a pipe. Hope this helps. > please upvote and accept answer if you find it useful - thanks! ... View more

It seems like you're missing the equal sign after your args of the second stanza. [fl(1)] # stands for First and Last args = StatsBy definition = stats count min(_time) as FIRST, max(_time) as LAST by $StatsBy$ | convert ctime(FIRST) timeformat="%m/%d/%y %H:%M" | convert ctime(LAST) timeformat="%m/%d/%y %H:%M" Hope this helps. > please upvote and accept answer if you find it useful - thanks! ... View more

See if this helps: <my search> | rex field=version mode=sed "s/\.//g" This will remove all dots from the field called version and convert it to a number. Hope this helps. > please upvote and accept answer if you find it useful - thanks! ... View more

Try this instead: sourcetype=smdr | eval duration=strptime(call_duration,"%H:%M:%S") | stats sum(duration) by Party1Name Hope this helps. > please upvote and accept answer if you find it useful - thanks! EDIT: The reason you need to use strptime functions is because Splunk looks at the call_duration as a simple string and not as seconds that can be added or performed any arithmetic functions on. Hope this clarifies it. ... View more

After some careful exploration I have an answer that might benefit the community. The short answer is "do not end your REGEX in backslash". A btool --debug for the above gives the following: splunk cmd btool --debug transforms list send_to_index system [send_to_index] system CAN_OPTIMIZE = True system CLEAN_KEYS = True system DEFAULT_VALUE = system DEST_KEY = system FORMAT = indexQueue system KEEP_EMPTY_VALS = False system LOOKAHEAD = 4096 system MV_ADD = False system REGEX = bar\\[[:alnum:]]\ DEST_KEY = queue system SOURCE_KEY = _raw system WRITE_META = False You clearly can see that DEST_KEY is not considered by the system and consequently the setup fails. The culprit behind this appears to be that last backslash. It turns out that in .conf files the presence of a backslash at the end of a line will escape the implied newline there. Easy Fix - do NOT end the REGEX with backslash: [send_to_index] REGEX = bar\\[[:alnum::]]\\\w+ DEST_KEY = queue FORMAT = indexQueue OR, if you need a backslash there, escape it and bracket it. [send_to_index] REGEX = bar\\[[:alnum::]][\\] DEST_KEY = queue FORMAT = indexQueue Hope this helps. ... View more