have a business area that changed some of their log format which broke my existing regex and having a hard time matching response code. seems my existing regex is pulling two matches from each event. (matching "fromIndex=150" or *"fromIndex=100"* also in the event) any suggestions to edit this? Existing regex: (working before log format change) \b(?<**http_status**>\d{3}) \d _raw data: 2019-05-30 17:52:15 127.0.0.1 GET /api/accounts/19006/account-history timePeriod=&type=&amount=&check=&description=&*startfromIndex=100* 1123 {"{“UserId”:crazy_carl,”Username”:”foo”,"Realm":"061120534","sessionTimeout":"20","ipAddress”:”127.1.1.1”} 127.0.0.1 Mozilla/5.0+(Windows+NT+6.1;+Win64;+x64;+rv:67.0)+Gecko/20100101+Firefox/67.0 https://my.bankingsite.com/ORUI/ **200** 0 0 3531 127.0.0.1 2019-05-30 17:52:05 127.0.0.1 GET /api/accounts/67343/account-history timePeriod=7&type=1&amount=&check=&description=&*startfromIndex=100* 1124 {"{“UserId”:crazy_carl,”Username”:”foo”,"Realm":"061120686","sessionTimeout":"20","ipAddress”:”127.1.1.1”} 127.0.0.1 Mozilla/5.0+(X11;+Linux+x86_64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/43.0.2357.125+Safari/537.36 https://my.bankingsite.com/ORUI/ **200** 0 0 875 127.0.0.1 2019-05-30 17:52:03 127.0.0.1 GET /api/accounts/46850/account-history timePeriod=&type=&amount=&check=&description=&*startfromIndex=100* 1120 {"{“UserId”:crazy_carl,”Username”:”foo”,"Realm":"091302966","sessionTimeout":"20","ipAddress”:”127.1.1.1”} 127.0.0.1 Mozilla/5.0+(Linux;+Android+7.0;+SM-G928V)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/73.0.3683.90+Mobile+Safari/537.36 https://my.bankingsite.com/ORUI/ **200** 0 0 3578 127.0.0.1 2019-05-30 17:51:51 127.0.0.1 GET /103103985/api/accounts/33098/account-history timePeriod=&type=&amount=&check=&description=&*startfromIndex=100* 80 {"{“UserId”:crazy_carl,”Username”:”foo”,"Realm":"103103985","sessionTimeout":"20","ipAddress”:”127.1.1.1”} 127.0.0.1 Mozilla/5.0+(Windows+NT+10.0;+WOW64;+Trident/7.0;+rv:11.0)+like+Gecko https://my.bankingsite.com/103103985/ORUI/ **200** 0 0 562 127.0.0.1 2019-05-30 17:51:50 127.0.0.1 GET /api/accounts/14342/account-history timePeriod=03/22/2019,05/30/2019&type=1&amount=&check=&description=&*startfromIndex=100* 1111 {"{“UserId”:crazy_carl,”Username”:”foo”,"Realm":"061120806","sessionTimeout":"20","ipAddress”:”127.1.1.1”} 127.0.0.1 Mozilla/5.0+(Windows+NT+6.1;+Win64;+x64;+rv:61.0)+Gecko/20100101+Firefox/61.0 https://my.bankingsite.com/ORUI/index.html 200 0 0 1718 127.0.0.1 2019-05-30 17:51:47 127.0.0.1 GET /api/accounts/128235/account-history timePeriod=1&type=1&amount=&check=&description=&*startfromIndex=100* 1101 {"{“UserId”:crazy_carl,”Username”:”foo”,"Realm":"053102586","sessionTimeout":"20","ipAddress”:”127.1.1.1”} 127.0.0.1 Mozilla/5.0+(X11;+Linux+x86_64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/43.0.2357.125+Safari/537.36 https://my.bankingsite.com/ORUI/ **200** 0 0 484 127.0.0.1 2019-05-30 17:51:43 127.0.0.1 GET /api/accounts/57435/account-history timePeriod=7&type=1&amount=&check=&description=&*startfromIndex=100* 1112 {"{“UserId”:crazy_carl,”Username”:”foo”,"Realm":"064106775","sessionTimeout":"20","ipAddress”:”127.1.1.1”} 127.0.0.1 Mozilla/5.0+(X11;+Linux+x86_64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/43.0.2357.125+Safari/537.36 https://my.bankingsite.com/ORUI/ **200** 0 0 1125 127.0.0.1 2019-05-30 17:51:41 127.0.0.1 GET /api/accounts/66752/account-history timePeriod=1&type=1&amount=&check=&description=&*startfromIndex=100* 1150 {"{“UserId”:crazy_carl,”Username”:”foo”,"Realm":"221971015","sessionTimeout":"20","ipAddress”:”127.1.1.1”} 127.0.0.1 Mozilla/5.0+(X11;+Linux+x86_64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/43.0.2357.125+Safari/537.36 https://my.bankingsite.com/ORUI/ **200** 0 0 187 127.0.0.1 2019-05-30 17:51:35 127.0.0.1 GET /api/accounts/290903/account-history timePeriod=1&type=1&amount=&check=&description=&*startfromIndex=100* 1127 {"{“UserId”:crazy_carl,”Username”:”foo”,"Realm":"102000966","sessionTimeout":"20","ipAddress”:”127.1.1.1”} 127.0.0.1 Mozilla/5.0+(X11;+Linux+x86_64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/43.0.2357.125+Safari/537.36 https://my.bankingsite.com/ORUI/ **200** 0 0 1562 127.0.0.1 2019-05-30 17:51:32 127.0.0.1 GET /api/accounts/36874/account-history timePeriod=1&type=1&amount=&check=&description=&*startfromIndex=100* 1107 {"{“UserId”:crazy_carl,”Username”:”foo”,"Realm":"063114030","sessionTimeout":"20","ipAddress”:”127.1.1.1”} 127.0.0.1 Mozilla/5.0+(X11;+Linux+x86_64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/43.0.2357.125+Safari/537.36 https://my.bankingsite.com/ORUI/ **200** 0 0 875 127.0.0.1 2019-05-30 17:51:30 127.0.0.1 GET /api/accounts/24299/account-history timePeriod=&type=&amount=&check=&description=&*startfromIndex=100* 1135 {"{“UserId”:crazy_carl,”Username”:”foo”,"Realm":"111908965","sessionTimeout":"20","ipAddress”:”127.1.1.1”} 127.0.0.1 Mozilla/5.0+(Windows+NT+6.1;+WOW64;+Trident/7.0;+rv:11.0)+like+Gecko https://my.bankingsite.com/ORUI/ **200** 0 0 6703 127.0.0.1 2019-05-30 17:51:17 127.0.0.1 GET /api/accounts/389912/account-history timePeriod=1&type=1&amount=&check=&description=&*startfromIndex=100* 1127 {"{“UserId”:crazy_carl,”Username”:”foo”,"Realm":"102000966","sessionTimeout":"20","ipAddress”:”127.1.1.1”} 127.0.0.1 Mozilla/5.0+(X11;+Linux+x86_64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/43.0.2357.125+Safari/537.36 https://my.bankingsite.com/ORUI/ **200** 0 0 765 127.0.0.1 2019-05-30 17:51:01 127.0.0.1 GET /pahranagatvalleyfcu/api/accounts/4058/account-history timePeriod=09/27/2016,05/30/2019&type=1&amount=&check=&description=&*startfromIndex=100* 1101 {"{“UserId”:crazy_carl,”Username”:”foo”,"Realm":"003381.MERCURY","sessionTimeout":"20","ipAddress”:”127.1.1.1”} 127.0.0.1 Mozilla/5.0+(Windows+NT+6.1;+Win64;+x64;+rv:61.0)+Gecko/20100101+Firefox/61.0 https://my.bankingsite.com/PahranagatValleyFCU/ORUI/index.html **200** 0 0 6546 127.0.0.1 2019-05-30 18:03:26 127.0.0.1 GET /api/system/logoff - 1118 - 127.0.0.1 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+10_14_4)+AppleWebKit/605.1.15+(KHTML,+like+Gecko)+Version/12.1+Safari/605.1.15 https://my.bankingsite.com/ORUI/ **401** 0 0 0 127.0.0.1 2019-05-30 18:03:26 127.0.0.1 GET /api/personalfinance/ widgetName=mini_spending_widget&sync=true 1118 - 127.0.0.1 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+10_14_4)+AppleWebKit/605.1.15+(KHTML,+like+Gecko)+Version/12.1+Safari/605.1.15 https://my.bankingsite.com/ORUI/ **401** 0 0 0 127.0.0.1 2019-05-30 18:03:26 127.0.0.1 GET /api/system/logoff - 1118 - 127.0.0.1 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+10_14_4)+AppleWebKit/605.1.15+(KHTML,+like+Gecko)+Version/12.1+Safari/605.1.15 https://my.bankingsite.com/ORUI/ **401** 0 0 15 127.0.0.1 2019-05-30 18:03:26 127.0.0.1 GET /api/system/logoff - 1118 - 127.0.0.1 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+10_14_4)+AppleWebKit/605.1.15+(KHTML,+like+Gecko)+Version/12.1+Safari/605.1.15 https://my.bankingsite.com/ORUI/ **401** 0 0 0 127.0.0.1 2019-05-30 18:03:26 127.0.0.1 GET /api/personalfinance/ widgetName=mini_spending_widget&sync=true 1118 - 127.0.0.1 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+10_14_4)+AppleWebKit/605.1.15+(KHTML,+like+Gecko)+Version/12.1+Safari/605.1.15 https://my.bankingsite.com/ORUI/ **401** 0 0 15 127.0.0.1 2019-05-30 18:03:26 127.0.0.1 GET /api/system/logoff - 1118 - 127.0.0.1 Mozilla/5.0+(Macintosh;+Intel+Mac+OS+X+10_14_4)+AppleWebKit/605.1.15+(KHTML,+like+Gecko)+Version/12.1+Safari/605.1.15 https://my.bankingsite.com/ORUI/ **401** 0 0 0 127.0.0.1 2019-05-30 18:03:26 127.0.0.1 GET /CommCUofNewMilford/api/users/22/getholdamount accountId=2175 1101 {"UserId”:crazy_carl,”Username”:”foo”,”Realm":"003042.MERCURY","sessionTimeout":"20","ipAddress":"107.77.224.32"} 127.0.0.1 Mozilla/5.0+(iPhone;+CPU+iPhone+OS+12_2+like+Mac+OS+X)+AppleWebKit/605.1.15+(KHTML,+like+Gecko)+Version/12.1+Mobile/15E148+Safari/604.1 https://my.bankingsite.com/CommCUofNewMilford/ORUI/ **200** 0 0 109 127.0.0.1 2019-05-30 18:03:25 127.0.0.1 GET /api/users/22/accounts assetSortOrder=ASC&assetDefaultSortColumn=accountName&investmentSortOrder=ASC&investmentDefaultSortColumn=accountName&liabilitiesortOrder=ASC&liabilitiesDefaultSortColumn=accountName&externalSortOrder=ASC&externalDefaultSortColumn=accountName&ccSortOrder=ASC&ccDefaultSortColumn=accountName 1101 {"UserId”:crazy_carl,”Username”:”foo”,”Realm":"111906271","sessionTimeout":"20","ipAddress":"127.0.0.1"} 127.0.0.1 Mozilla/5.0+(Linux;+Android+9;+SM-G955U)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/74.0.3729.157+Mobile+Safari/537.36 https://my.bankingsite.com/ORUI/ **200** 0 0 140 127.0.0.1 2019-05-30 18:03:25 127.0.0.1 GET /login.aspx ReturnUrl=%2fORUI%2f 1101 - 127.0.0.1 Mozilla/5.0+(iPhone;+CPU+iPhone+OS+12_3_1+like+Mac+OS+X)+AppleWebKit/605.1.15+(KHTML,+like+Gecko)+Version/12.1.1+Mobile/15E148+Safari/604.1 - **200** 0 0 46 172.58.99.130 2019-05-30 18:03:25 127.0.0.1 GET /api/users/22/scorecardrewards - 1101 {"UserId”:crazy_carl,”Username”:”foo”,”Realm":"111906271","sessionTimeout":"20","ipAddress":"127.0.0.1"} 127.0.0.1 Mozilla/5.0+(Linux;+Android+9;+SM-G955U)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/74.0.3729.157+Mobile+Safari/537.36 https://my.bankingsite.com/ORUI/ **200** 0 0 46 127.0.0.1 2019-05-30 18:03:25 127.0.0.1 GET /ORUI/index.html - 1101 {"UserId”:crazy_carl,”Username”:”foo”,”Realm":"111906271","sessionTimeout":"20","ipAddress":"127.0.0.1 "} 127.0.0.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/74.0.3729.169+Safari/537.36 https://my.bankingsite.com/PassMarkRecognizedAdv.aspx?qs=b2TU7c2wr8E0dfptJiVc6osqODJNVVaa6UZusUsRdZI%3d **200** 0 0 125 127.0.0.1 2019-05-30 18:03:25 127.0.0.1 GET /OOBChallenge.aspx qs=cUlHrH9oGju91rnRg%2bOmkzrLhg8Oc0ZMSvVHZDwpaoNAhY0dPG6o3WXkCMUZMARx61iChJjKqmntkcKCmNEX9oD2KDmMage%2fb2TU7c2wr8E0dfptJiVc6osqODJNVVaan3drqxuh3WzZy%2fva1rs6RM9OaC59wRrRZ2yA%2bDcWz7lmJSZPd2bHwWdceDRZ9bE2QNZL%2f5%2fuohrofoZvlVaPJA%3d%3d 1101 - 127.0.0.1 Mozilla/5.0+(Windows+NT+6.1;+Trident/7.0;+rv:11.0)+like+Gecko https://my.bankingsite.com/SignOn.aspx?qs=nLl1ZWczEjHofoZvlVaPJA%3d%3d **200** 0 0 453 127.0.0.1 ... View more

Having issues with a sedcmd in my props. When I test this in my dev environment, I see expected results. However, when I apply this to my distributed environment and push it to my indexers, I am not seeing the same results. Does not seem to be stripping the excess data when applied to the indexer cluster. Also, I did try this in a props.conf on a HF fronting our cluster, and still did not work. props.conf [my_lil_old_sourcetype] SHOULD_LINEMERGE=false LINE_BREAKER=([\r\n]+) NO_BINARY_CHECK=true CHARSET=UTF-8 MAX_TIMESTAMP_LOOKAHEAD=15 disabled=false TIME_FORMAT=%Y%m%d:%H%M%S TIME_PREFIX=##TUXIF: TZ=GMT SEDCMD-purge=s/^(?!##TUXIF).+//g DEV results: (good) TUXIF:20190523:164904:000001.273:529021******2906/0:110:100:1:MCRD->APS:150.000:978:2052658003:0/00:NP:NP:NP TUXIF:20190523:164904:000000.450:550129******1803/0:110:100:0:MCRD->FRT:22.800:978:118875070:0/00:NP:NP:NP TUXIF:20190523:164904:000000.346:446223******7606/0:110:100:0:VISA->BOV:760.000:826:118875080:0/00:NP:NP:NP TUXIF:20190523:164904:000000.257:559147******8697/0:110:100:0:MCRD->BNK:1.800:978:118875090:0/00:NP:NP:NP TUXIF:20190523:164904:000000.385:446223******3604/0:110:100:0:VISA->BOV:7.000:826:118875060:0/00:NP:NP:NP TUXIF:20190523:164904:000000.412:550129******3036/0:110:100:0:MCRD->FRT:2.300:978:118875050:0/00:NP:NP:NP TUXIF:20190523:164904:000000.231:446223******3902/0:110:100:0:VISA->BOV:14.710:826:118875065:0/00:NP:NP:NP TUXIF:20190523:164904:000000.285:479613******0487/0:110:100:0:VISA->PMM:3.100:826:118875055:0/00:NP:NP:NP TUXIF:20190523:164904:000000.248:557418******4844/0:110:100:0:MCRD->PCT:20.050:826:118875040:0/00:NP:NP:NP TUXIF:20190523:164904:000000.216:465850******1704/0:110:100:0:VISA->BOV:4.730:826:118875045:0/00:NP:NP:NP TUXIF:20190523:164904:000002.785:472628******5886/0:110:100:0:VISA->PKT:2.750:826:118874935:0/00:NP:NP:NP TUXIF:20190523:164903:000000.122:401773******6492/0:110:100:0:VISA->GVS:38.000:978:118875035:1/16:NP:NP:Insufficient Funds ! (Txn amount 38.000 (including commission 0.000), Available amount 30.000, Override 0.000 ) TUXIF:20190523:164903:000000.293:446223******6804/0:110:100:0:VISA->BOV:2.990:826:118875030:0/00:NP:NP:NP TUXIF:20190523:164903:000000.598:550129******9908/0:110:100:0:MCRD->FRT:37.000:978:118874990:0/00:NP:NP:NP TUXIF:20190523:164903:000000.218:446223******8302/0:110:100:0:VISA->BOV:9.690:826:118875025:0/00:NP:NP:NP TUXIF:20190523:164903:000000.337:557362******0812/0:110:100:0:MCRD->ANP:16.060:978:118875020:0/00:NP:NP:NP TUXIF:20190523:164903:000000.593:533935******3582/0:110:100:0:MCRD->PSH:92.250:978:118874985:0/00:NP:NP:NP TUXIF:20190523:164903:000000.283:511656******0698/0:110:100:1:MCRD->ACL:203.500:840:118875000:0/00:NP:NP:NP TUXIF:20190523:164903:000002.552:472628******8479/0:110:100:0:VISA->PKT:3.200:826:118874900:0/00:NP:NP:NP TUXIF:20190523:164903:000002.596:472628******5328/0:110:100:0:VISA->PKT:1.000:826:118874895:0/00:NP:NP:NP raw log data (without stripping data) 3528484:20190523:16490195:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/06/559147_2406_0001] TUXIF:20190523:164902:000000.394:559147******2406/0:110:100:0:MCRD->BNK:26.950:949:118874950:0/00:NP:NP:NP 6161662:20190523:16490245:TUXCLT:slfdbg.c:1033:Could not SET NAME BY PAN - NO PAN AVAILABLE ! ******************************** TUXCLT service ******************************** 6161662:20190523:16490245:TUXCLT:slfdbg.c: 667:Service called with: C_FNCODE 831 I_REQ_CHARSET 0 C_STAN 704534 46923944:20190523:16490128:TUXIF :slfdbg.c:1252:Setting file to I_DBGFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/47/540450_6247_0007] TUXIF:20190523:164901:000000.261:540450******6247/0:110:100:1:MCRD->APS:40.000:826:2052657978:1/16:NP:NP:Insufficient Funds ! (Txn amount 40.500 (including commission 0.500), Available amount 4.930, Override 0.000 ) 40239190:20190523:16490090:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/71/529021_6671_0006] TUXIF:20190523:164901:000000.628:529021******6671/0:110:100:0:MCRD->APS:147.440:826:2052657973:0/00:NP:NP:NP 37748910:20190523:16490158:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/49/540450_2249_0002] TUXIF:20190523:164901:000000.244:540450******2249/0:110:100:0:MCRD->APS:9.480:826:2052657988:0/00:NP:NP:NP 49217788:20190523:16490051:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/85/516240_0385_0003] TUXIF:20190523:164901:000001.363:516240******0385/0:110:100:0:MCRD->YTG:100.000:702:2052657968:0/00:NP:NP:NP 35782700:20190523:16490133:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/00/516240_1200_0002] TUXIF:20190523:164901:000000.573:516240******1200/0:110:100:0:MCRD->YTG:27.080:840:2052657983:0/00:NP:NP:NP 50921508:20190523:16490184:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/28/540450_8228_0006] TUXIF:20190523:164902:000000.231:540450******8228/0:110:100:0:MCRD->APS:12.000:826:2052657993:0/00:NP:NP:NP 39190644:20190523:16490207:TUXCLT:slfdbg.c:1033:Could not SET NAME BY PAN - NO PAN AVAILABLE ! ******************************** TUXCLT service ******************************** 39190644:20190523:16490207:TUXCLT:slfdbg.c: 667:Service called with: C_FNCODE 831 I_REQ_CHARSET 0 C_STAN 705292 C_RRN 914315704534 C_RSPCODE 00 M_SEVCODE TUXIF M_SEVCODE TUXCLT 6161662:20190523:164902:TUXCLT:GSM: Event ev_ok 6161662:20190523:16490245:TUXCLT:GSM: State st_return (0.00)[0.00] 6161662:20190523:16490245:TUXCLT:xcltsm.c: 545:M_err: 0 6161662:20190523:164902:TUXCLT:GSM: event DEFAULT [0] 6161662:20190523:16490245:TUXCLT: tuxif.c: 340:TUXCLT Return: TPSUCCESS ************************* Start of Fielded Buffer Diff ************************* Diff FB's : (+)Added by svc, (-) Deleted by svc, (C) Changed by svc (C) C_MSGFN [0] : from 0 to 1 (+) C_ACTIONCODE [0] : 8 (+) C_RSPCODE [0] : 00 *************************** ntp_return from : TUXCLT *************************** 30344220:20190523:16490147:TUXIF :slfdbg.c:1252:Setting file to I_DBGFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/14/528838_8914_0003] TUXIF:20190523:164902:000001.218:528838******8914/0:110:100:1:MCRD->NET:50.000:978:118874945:0/00:NP:NP:NP 21824832:20190523:16490003:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/04/472628_0904_0001] TUXIF:20190523:164902:000002.656:472628******0904/0:110:100:0:VISA->PKT:46.900:826:118874865:0/00:NP:NP:NP 45745202:20190523:16490258:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/04/446223_5904_0048] TUXIF:20190523:164902:000000.235:446223******5904/0:110:100:0:VISA->BOV:6.990:826:118874955:0/00:NP:NP:NP 36046094:20190523:16490022:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/84/472628_4984_0003] TUXIF:20190523:164902:000002.656:472628******4984/0:110:100:0:VISA->PKT:2.000:826:118874875:0/00:NP:NP:NP 36767094:20190523:16490266:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/04/446223_9804_0083] TUXIF:20190523:164902:000000.319:446223******9804/0:110:100:0:VISA->BOV:1.000:978:118874960:0/00:NP:NP:NP 61015798:20190523:16490270:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/95/459340_6895_0009] TUXIF:20190523:164903:000000.295:459340******6895/0:110:100:0:VISA->SDS:6.440:978:118874965:0/00:NP:NP:NP 1377470:20190523:16490301:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/12/550129_3212_0007] 5702746:20190523:16490284:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/76/479613_7376_0004] TUXIF:20190523:164903:000000.295:479613******7376/0:110:100:0:VISA->PMM:7.320:826:118874975:0/00:NP:NP:NP 1377470:20190523:16490302:TUXIF :slfdbg.c:1252:Setting file to I_DBGFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/12/550129_3212_0007] TUXIF:20190523:164903:000000.245:550129******3212/0:110:100:1:MCRD->FRT:403.000:978:118874980:1/16:NP:NP:Insufficient Funds ! (Txn amount 405.000 (including commission 2.000), Available amount 218.360, Override 0.000 ) 62064218:20190523:16490329:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/98/511656_0698_0000] 43189706:20190523:16490335:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/93/472628_4893_0001] 27919656:20190523:16490336:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/94/472628_3194_0002] 6161730:20190523:16490322:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/66/401773_4766_0001] TUXIF:20190523:164903:000000.195:401773******4766/0:110:100:0:VISA->GVS:5.000:978:118874995:0/00:NP:NP:NP 52757842:20190523:16490330:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/38/401773_3438_0005] TUXIF:20190523:164903:000000.167:401773******3438/0:110:100:0:VISA->GVS:11.970:978:118875005:1/16:NP:NP:Insufficient Funds ! (Txn amount 11.970 (including commission 0.000), Available amount 10.030, Override 0.000 ) 29362098:20190523:16490089:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/28/472628_5328_0006] TUXIF:20190523:164903:000002.596:472628******5328/0:110:100:0:VISA->PKT:1.000:826:118874895:0/00:NP:NP:NP 41223354:20190523:16490094:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/79/472628_8479_0003] TUXIF:20190523:164903:000002.552:472628******8479/0:110:100:0:VISA->PKT:3.200:826:118874900:0/00:NP:NP:NP 62064218:20190523:16490331:TUXIF :slfdbg.c:1252:Setting file to I_DBGFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/98/511656_0698_0000] TUXIF:20190523:164903:000000.283:511656******0698/0:110:100:1:MCRD->ACL:203.500:840:118875000:0/00:NP:NP:NP 65406164:20190523:16490304:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/82/533935_3582_0001] TUXIF:20190523:164903:000000.593:533935******3582/0:110:100:0:MCRD->PSH:92.250:978:118874985:0/00:NP:NP:NP 15664278:20190523:16490339:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/12/557362_0812_0000] TUXIF:20190523:164903:000000.337:557362******0812/0:110:100:0:MCRD->ANP:16.060:978:118875020:0/00:NP:NP:NP 43647120:20190523:16490353:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/02/446223_8302_0072] TUXIF:20190523:164903:000000.218:446223******8302/0:110:100:0:VISA->BOV:9.690:826:118875025:0/00:NP:NP:NP 34997348:20190523:16490316:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/08/550129_9908_0003] TUXIF:20190523:164903:000000.598:550129******9908/0:110:100:0:MCRD->FRT:37.000:978:118874990:0/00:NP:NP:NP 32572628:20190523:16490366:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/04/446223_6804_0063] TUXIF:20190523:164903:000000.293:446223******6804/0:110:100:0:VISA->BOV:2.990:826:118875030:0/00:NP:NP:NP 39061038:20190523:16490386:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/92/401773_6492_0001] TUXIF:20190523:164903:000000.122:401773******6492/0:110:100:0:VISA->GVS:38.000:978:118875035:1/16:NP:NP:Insufficient Funds ! (Txn amount 38.000 (including commission 0.000), Available amount 30.000, Override 0.000 ) 21497278:20190523:16490131:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/86/472628_5886_0001] TUXIF:20190523:164904:000002.785:472628******5886/0:110:100:0:VISA->PKT:2.750:826:118874935:0/00:NP:NP:NP 10880444:20190523:16490389:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/04/465850_1704_0007] TUXIF:20190523:164904:000000.216:465850******1704/0:110:100:0:VISA->BOV:4.730:826:118875045:0/00:NP:NP:NP 48039384:20190523:16490389:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/44/557418_4844_0004] TUXIF:20190523:164904:000000.248:557418******4844/0:110:100:0:MCRD->PCT:20.050:826:118875040:0/00:NP:NP:NP 15402590:20190523:16490393:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/87/479613_0487_0002] TUXIF:20190523:164904:000000.285:479613******0487/0:110:100:0:VISA->PMM:3.100:826:118875055:0/00:NP:NP:NP 62981760:20190523:16490405:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/02/446223_3902_0078] TUXIF:20190523:164904:000000.231:446223******3902/0:110:100:0:VISA->BOV:14.710:826:118875065:0/00:NP:NP:NP 14091452:20190523:16490390:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/36/550129_3036_0003] TUXIF:20190523:164904:000000.412:550129******3036/0:110:100:0:MCRD->FRT:2.300:978:118875050:0/00:NP:NP:NP 6555816:20190523:16490404:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/04/446223_3604_0055] TUXIF:20190523:164904:000000.385:446223******3604/0:110:100:0:VISA->BOV:7.000:826:118875060:0/00:NP:NP:NP 29165424:20190523:16490442:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/97/559147_8697_0003] TUXIF:20190523:164904:000000.257:559147******8697/0:110:100:0:MCRD->BNK:1.800:978:118875090:0/00:NP:NP:NP 51381636:20190523:16490435:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/06/446223_7606_0079] TUXIF:20190523:164904:000000.346:446223******7606/0:110:100:0:VISA->BOV:760.000:826:118875080:0/00:NP:NP:NP 27002354:20190523:16490429:TUXIF :slfdbg.c: 993:Setting file to I_DBGPANFILE fb value [/cortex/dbd/tmp/TXNS_BY_PAN/03/550129_1803_0000] TUXIF:20190523:164904:000000.450:550129******1803/0:110:100:0:MCRD->FRT:22.800:978:118875070:0/00:NP:NP:NP M_SEVSEC 1558626542 M_SEVUSEC 453936 M_SEVUSEC 459348 C_MSGCLS 8 C_MSGFN 1 C_TXNSRC 0 C_ACTIONCODE 8 I_SRCHOST APS I_DSTHOST DBD C_DATEXMIT 20190523 C_TIMEXMIT 154902 M_SEVSEC 1558626542 C_RRN 914315704534 M_SEVCODE TUXIF M_SEVCODE TUXCLT 6161662:20190523:16490245:TUXCLT:GSM: State st_chk_msg (0.00)[0.00] 6161662:20190523:16490245:TUXCLT:xcltsm.c: 259:Looking for I_SRCHOST [APS] in hostmap 6161662:20190523:16490245:TUXCLT:xcltsm.c: 266:Host IBB not match 6161662:20190523:16490245:TUXCLT:xcltsm.c: 266:Host IDT not match 6161662:20190523:16490245:TUXCLT:xcltsm.c: 266:Host NWC not match 6161662:20190523:16490245:TUXCLT:xcltsm.c: 266:Host BOI not match 6161662:20190523:16490245:TUXCLT:xcltsm.c: 266:Host NAG not match 6161662:20190523:16490245:TUXCLT:xcltsm.c: 273:Host APS OK, afe = APS 6161662:20190523:16490245:TUXCLT:xcltsm.c: 300:I_AFE changed 6161662:20190523:164902:TUXCLT:GSM: Event ev_nmgrq 6161662:20190523:16490245:TUXCLT:GSM: State st_snd_nmg (0.00)[0.00] 6161662:20190523:16490245:TUXCLT: cocbf.c: 588:MFN_REQ -> MFN_REQRSP 6161662:20190523:16490245:TUXCLT: cocbf.c: 628:No actioncode originally 6161662:20190523:16490245:TUXCLT: cocbf.c: 652:Set action/rsp codes to 800 6161662:20190523:164902:TUXCLT:GSM: Event ev_ok 6161662:20190523:16490245:TUXCLT:GSM: State st_snd_rply (0.00)[0.00] 6161662:20190523:16490245:TUXCLT:uxifcv.c: 188:Entered conv_fb 6161662:20190523:16490245:TUXCLT:uxifcv.c: 196:Conversion table for Incoming transaction response found 6161662:20190523:16490245:TUXCLT:convcs.c: 253:I_REQ_CHARSET found 6161662:20190523:16490245:TUXCLT:convcs.c: 125:Characterset is same 6161662:20190523:16490245:TUXCLT:convcs.c: 138:No conversion is done 6161662:20190523:16490245:TUXCLT:uxifcv.c: 221:Convertion started 6161662:20190523:16490245:TUXCLT:uxifcv.c: 328:Convertion end 6161662:20190523:16490245:TUXCLT:uxifcv.c: 346:Leaving conv_fb 6161662:20190523:16490245:TUXCLT:slfdbg.c: 667:FB after second conv_fb: C_FNCODE 831 I_REQ_CHARSET 0 C_STAN 704534 M_SEVSEC 1558626542 M_SEVUSEC 453936 M_SEVUSEC 459348 C_MSGCLS 8 C_MSGFN 0 C_TXNSRC 0 I_SRCHOST APS I_DSTHOST DBD C_DATEXMIT 20190523 C_TIMEXMIT 154902 M_SEVSEC 1558626542 C_RRN 914315705292 C_RSPCODE 00 M_SEVCODE TUXIF M_SEVCODE TUXCLT 39190644:20190523:164902:TUXCLT:GSM: Event ev_ok 39190644:20190523:16490207:TUXCLT:GSM: State st_return (0.00)[0.00] 39190644:20190523:16490207:TUXCLT:xcltsm.c: 545:M_err: 0 39190644:20190523:164902:TUXCLT:GSM: event DEFAULT [0] 39190644:20190523:16490207:TUXCLT: tuxif.c: 340:TUXCLT Return: TPSUCCESS ************************* Start of Fielded Buffer Diff ************************* Diff FB's : (+)Added by svc, (-) Deleted by svc, (C) Changed by svc (C) C_MSGFN [0] : from 0 to 1 (+) C_ACTIONCODE [0] : 8 (+) C_RSPCODE [0] : 00 *************************** ntp_return from : TUXCLT *************************** ... View more

We want to extract existing data (very little, less than a GB) from an index. Is there a best practice for running the dump command on an indexer cluster (3 nodes) for a specific index? Do I have to run this command individually on each indexer in the cluster to ensure all data in the cluster is extracted properly? ... View more

Trying to do a linebreak on "CIB" being passed into log. (I know, these logs are awful) Having problems breaking on the CIB expression though. Any suggestions? Splunk wants to break on OFX SHOULD_LINEMERGE=false LINE_BREAKER=(^(?P\w+\s+)) TZ=America/Chicago Log Format: CIB 2019-05-06 09:07:30,839] [THREAD: iner : 17] com.ffusion.ffs.ofx.servlets.OFXServlet - Mon May 06 09:07:30 CDT 2019: OFXServlet: OFXHEADER:100 DATA:OFXSGML VERSION:151 SECURITY:NONE ENCODING:USASCII Show all 9 lines 20190506090730.831 19640191 ctaxnqidzgkzuete1557133644150B1732PK0400 ENG 426 051900395 CIB 0200 Y PROD -2b777cc0:16a8c453ac4:-2a0a 051900395 87836273 CHECKING 20190506 20190506 Y Y 20190506090730.796 13927199 wlipfswymcgvelcy1557133638179B1182PK0400 ENG 642 071901604 CIB 0200 Y PROD -12f8b87f:16a8c39e671:-e19 071901604 3332930001 CHECKING 20190506 20190506 Y Y CIB 2019-05-06 09:07:30,724] [THREAD: iner : 40] com.ffusion.ffs.ofx.servlets.OFXServlet - Mon May 06 09:07:30 CDT 2019: OFXServlet: RQID:20190506140725.981_5323260_zoadfefhnclstbhc1557151644827B2797PK0900 user: null is authorized CIB 2019-05-06 09:07:30,724] [THREAD: iner : 40] com.ffusion.ffs.ofx.servlets.OFXServlet - Inside New Parser processing CIB 2019-05-06 09:07:30,885] [THREAD: iner : 40] com.ffusion.ffs.ofx.servlets.OFXServlet - Mon May 06 09:07:30 CDT 2019: OFXServlet: OFXHEADER:100 DATA:OFXSGML VERSION:151 Show all 12 lines CIB 2019-05-06 09:07:30,723] [THREAD: iner : 40] com.ffusion.ffs.ofx.servlets.OFXServlet - Mon May 06 09:07:30 CDT 2019: OFXServlet: RQID:20190506140725.981_5323260_zoadfefhnclstbhc1557151644827B2797PK0900 OFXHEADER:100 DATA:OFXSGML VERSION:151 SECURITY:NONE ENCODING:USASCII Show all 9 lines 20190506090730.708 9866661 vfhntpuabsayykui1557133650682B1172PK0400 ENG 774 084201294 CIB 0200 Y PROD -12f8b87f:16a8c39e671:-e1b 19990101 Y Y N Y Y 20190506090730.670 11761432 zhecbsmbwliobrgk1557133646660B2948PK0400 ENG 144 111102758 CIB 0200 Y PROD -125ceb71:16a8c6053a2:-7e56 TRHST 500 111102758 261503081 CHECKING 20190410 20190506 Y 20190506090730.647 8480130 yxsidmahmlailtri1557133622247B2718PK0400 ENG 448 325081306 CIB 0200 Y PROD -125ceb71:16a8c6053a2:-7e5a ESP 20180406 20190506 2000510-1 LOAN 20190506090730.639 8964814 ooaxvqjugedktndw1557133650611B2878PK0400 ENG 092 211871691 CIB 0200 Y PROD -12f8b87f:16a8c39e671:-e1f 19990101 Y Y N Y 20190506090730.633 8437258 yqfixwpbmjyuxycs1557133650578B2585PK0400 ENG 158 071925567 CIB 0200 Y PROD 4c4e9ea8:16a8bfa5cde:-68b2 19990101 Y Y N Y 20190506090730.621 9516145 oaergmlhxnraymbb1557133647475B2893PK0400 ENG 446 096010415 CIB 0200 Y PROD -492b898c:16a8a6f9bd4:4ba5 TRHST 500 096010415 69833115 SAVINGS 20190429 20190506 Y ... View more

I've written a search that charts data into a table. The query extracts run times greater than 25% over its calculated average value from the past 60 days. However, when I run the search, the run_time values are not lining up with the start_time values in the raw events. I'm probably missing something very simple, but I have been looking at this for so long. I figured maybe someone could pick up what I am doing wrong pretty quickly. The start_time and run_time values don't line up correctly with the _raw data in the events. index=foo sourcetype=bar firm_number="24" | strcat firm_name " - Firm Number: " firm_number AS Firm | bin _time span=60d | eventstats avg(duration_minutes) as avg_time by Firm | eval perc_of_change=round(((duration_minutes-avg_time)/duration_minutes)*100,2) | where perc_of_change > 25 | stats values(duration_minutes) as run_time values(start_time) as start_time first(avg_time) as avg_time by Firm | fields - _time ... View more

I've created a chart that only shows run times above a 60 day average and it's corresponding average, which works perfectly. However, now my users are looking to narrow these to occurrences that are 15% and higher than said average, evidently it's too difficult to look at the numbers I am already presenting. Any suggestions based on my existing search I have working? index=global_foo sourcetype=prd_global_bar_log firm_name="*" start_time="*" firm_number="*" | strcat firm_name " - Firm Number: " firm_number AS Firm | bin _time span=60d | eventstats avg(duration_minutes) as avg_time by Firm | where duration_minutes > avg_time | eval date_wday_new=if(date_wday="sunday","1. Sunday",if(date_wday="monday","2. Monday",if(date_wday="tuesday","3. Tuesday",if(date_wday="wednesday","4. Wednesday",if(date_wday="thursday","5. Thursday",if(date_wday="friday","6. Friday",if(date_wday="saturday","7. Saturday","unknown"))))))) | chart values(duration_minutes) as run_time by Firm date_wday_new | appendcols [ search index=global_foo sourcetype=prd_global_bar_log firm_name="*" start_time="*" firm_number="*" | stats avg(duration_minutes) as Average by firm_name] ... View more

Hello - we are looking to present daily run time values of events in a search, but only display the daily run time values that are greater than the calculated 30 day run time average. I've tried the eventstats with a where command, but doesn't seem like where plays nice with the values command. I tried using first instead of values, but that seems to skew the daily results. any suggestions? perhaps a sub search? our_search | eventstats values(duration_minutes) as run_time by firm_name | eventstats avg(duration_minutes) as avg_time by firm_name | where run_time>avg_time | timechart span=1d values(run_time) by firm_name ... View more