I didn't check your regex earlier, but I checked it now and there are some things that need to be addressed: "\" is an invalid character in a named capturing group Need to account for new lines. I've modified the regex and it should work to capture what you're looking for. I would use the $1::$2 notation for this in transforms.conf . I don't know if there are new line characters in your event data or if you just added them for readability here. If there are no new line characters in your events, just remove the \n 's from the regex below: \{foo\.(\w+):\s*([^,\}]*),\nfoo\.(\w+):\s*([^,\}]*),\nfoo\.(\w+):\s*([^,\}]*)\} ... View more

I don't know if it supports multiple tabs or not, but try out the Splunk ODBC app. Docs for the app are here. ... View more

Can you share your props.conf and transforms.conf lines for the PAYXLINE_MV field? ... View more

No problem, happy to help! ... View more

Did you add the name of your transform to a REPORT class in props.conf for your sourcetype/source/host? transforms.conf [myTransform] REGEX = \{foo\.(\w+):\s*(?<\1>[^,\}]*),foo\.(\w+):\s*(?<\2>[^,\}]*),foo\.(\w+):\s*(?<\3>[^,\}]*)\} FORMAT = $1::2 $3::$4 $5::$6 props.conf [mySourceType] REPORT-myUniqueClassName = myTransform ... View more

No, this would stay a search time extraction. transforms.conf just has a few more tricks up its sleeve when it comes to field extractions. See the docs on REGEX and the FORMAT attribute here. ... View more

Getting past the extra white space is easy enough with a slightly modified regex (the extra white space and current formatting of the events with line breaks was not in the original post). To extract multiple values of the same field from a single event, you need to add your extraction to transforms.conf and add MV_ADD = True , then either create a new report stanza or add to an existing report stanza in props.conf for the host, source, or sourcetype that the field is associated with. For this example, I'll use a sourcetype of 'waterfall': transforms.conf [Security_ID_Extraction] REGEX = Security\sID:\s+(?<SecurityID>.*)\n MV_ADD = True props.conf [waterfall] REPORT-waterfall_fields = Security_ID_Extraction ... View more

Try this to see if it works: ... search terms here ... | rex "Security\sID:\s(?<Security_ID>.*)\sData\sLanguage" If so, you can add the regular expression into your props.conf file to extract the field automatically. ... View more

So you pushed the configuration out to your search heads... What is the status of the knowledge bundle? splunk show cluster-bundle-status Have you tried refreshing or restarting your search head? You can refresh at https://your_splunk_url:port/en-US/debug/refresh Have you checked the permissions on the field transformation? They are most likely fine but I'm trying to cover all bases. Settings --> Fields --> Field Transformations. ... View more

It looks like you're missing the name of the new field in your transforms.conf stanza. Assuming you want the field to show up in Splunk as vdsHost, It should be: [vdsHost_extract] REGEX = instances/(?<vdsHost>[^/]+) SOURCE_KEY = source Or if you want to do it the old school way: [vdsHost_extract] REGEX = instances/([^/]+) FORMAT = vdsHost::$1 SOURCE_KEY = source ... View more

This is it. When you use endswith , you are telling the transaction function what criteria to look for to close a transaction. Endswith can be either a search statement (just like what would be written in the search bar), or can be an eval statement. If you use an eval statement it looks for whatever criteria you've declared in that eval. In your case, it's looking for the first event that returns true when the _raw field contains either "complete" or "terminated". You could just as easily write: endswith="complete OR terminated" and it would look for the matching strings. ... View more

Also note that the class names in each props.conf report stanza should be unique. ... View more

Like @David said, props/transforms.conf is the way to go. From the docs on using props.conf only extractions: All extraction configurations in props.conf are restricted by a specific source, source type, or host. Start by identifying the source type, source, or host that provide the events that your field should be extracted from Also from the docs on transforms.conf extractions: Your search-time field extractions require a field transform component if you need to: • Reuse the same field-extracting regular expression across multiple sources, source types, or hosts (in other words, configure one field transform for multiple field extractions). If you find yourself using the same regex to extract fields for different sources, source types, and hosts, you may want to set it up as a transform. Then, if you find that you need to update the regex, you only have to do so once, even though it is used more than one field extraction. So you can't wildcard the sourcetype. To dowhat you want while making maintenance easy, create a field transform in transforms.conf and reference it in props.conf for each host/source/sourcetype to which it applies: transforms.conf: [myNewFieldExtract] REGEX = instances\/(?<NewFieldName>[^\/]+) SOURCE_KEY = source props.conf: [sourcetype::first_sourcetype_this_applies_to] REPORT-my_class_name = myNewFieldExtract [sourcetype::second_sourcetype_this_applies_to] REPORT-my_class_name = myNewFieldExtract ... and so on... ... View more

From the docs: startswith = A search or eval filtering expression which, if satisfied by an event, marks the beginning of a new transaction. endswith = A search or eval filtering expression which, if satisfied by an event, marks the end of a transaction. So startswith should be a string or eval expression that identifies an event as the start of a transaction, and endswith should be a string or eval expression that identifies an event as the end of a transaction. See the docs on transaction here. Your new Difference field will be over in the left side of the screen with the rest of the fields. ... View more

Very close! You don't have to put a specific GUID into the transaction statement, you just have to tell transaction which field to use to correlate the events. It would be this: ...| transaction GUID startswith="Request" endswith="Response" maxevents=2 | eval Difference=Response-Request ... View more

Ok if they are in separate events you will first need to link them together using either stats or transaction . If you post some sample events we can help with correlating them if you need it. After you've linked/correlated the events you can use eval to get the difference in Response and Request . As a generic example, something like this: ... search terms here ... | transaction startswith="Request" endswith="Response" maxevents=2 | eval Difference=Response-Request ... View more

Are Response and Request in the same event or are they in separate events? ... View more

Transaction automatically creates a field called duration that is the difference between the earliest and latest events in the transaction. If your Timestamp field is the same as the _time field in each event, the work is already done for you. Just a side note, I'd recommend beefing up your transaction definition so that you can ensure the events that are paired together actually go together. By default, transaction combines events based on time, so if you have two CalculateTaxRequests start one after another, they could be combined into a transaction and your statistics would be off. Perhaps a transaction definition like this? index=all GUID="*" AND *calculatetax* Timestamp="*" | transaction GUID startswith=CalculateTaxRequests endswith=CalculateTaxResponse maxevents=2 ... View more

Oops, doesn't quite work they way I thought. Disregard this answer. ... View more

Have you tried using multi-series mode? Just set multi-series mode to "yes" in your chart properties and Splunk will make a different chart for each of the field you are splitting by (host in your case). This won't give each chart its own panel, but it will give a chart for each host. Is that close enough? ... View more

I don't think the one lookup being a DB lookup should affect it, my first lookup is a DB lookup and the second lookup is a file based lookup that chains off of it. Can you post the relevant parts of your transforms.conf and props.conf files? ... View more

This regex appears to work as you want, and should work as long as there is a comma at the end of field three: ,(?<Field1>[^,]+),(?<Field2>[^,]+),(?<Field3>.*), ... View more

Yes, you can use the output of one lookup as an input to another lookup in an automatic lookup. I have this set up and working on my system. Splunk processes your lookup files in alphabetical order by the name of the lookup. You need to ensure that the file containing the field that will be used as an input to another automatic lookup is processed BEFORE the automatic lookup that needs that field. So, if the_first_lookup outputs a field that is needed for a_later_lookup to work, I need to rename a_later_lookup so that it will be processed AFTER the_first_lookup , such as zz_a_later_lookup . ... View more

You can use the code block button in the editor (the one with 1's and 0's on it), or just indent the line with your search code 4 spaces and it should make it display correctly. ... View more