Try this please using rex assuming your fieild is called myField and data of interest will be collected in field called stringOfInterest : your query to return events | rex field=myField "\.+(?<stringOfInterest>.*)" | table stringOfInterest See Extraction here ... View more

If still required, can you check this one which shall work in most of the cases: your query to return events | rex field=_raw"\s*(\s*\|\s*(?<captureMe>[^\|]+)\|\s*)" | table captureMe See extraction here ... View more

If still required, this regex might be of help to cover all the scopes: your base search | rex field=_raw "\/((?<prefix>[^\s\/]+)\/)*(?<fileName>.*)" | table prefix, fileName See Extraction here ... View more

How about using the last which returns the last seen (oldest) version as search is in reverse chronological order, something like this: | inputlookup your csv name | stats last(Date) by Version | sort Version Alternatively you can use first to reverse the affect: | inputlookup your csv name | stats first(Date) by Version | sort Version ... View more

If by changing the index you want to change it to go to default main index you can definitely follow these steps mentioned in readme By default, the IMAP app will create a new Splunk index named "mail". This is controlled by: default/indexes.conf. If you want the IMAP output to go to the default Splunk index: 1. Remove "index = mail" reference in default/inputs.conf 2. Delete the default/index.conf file. 3. Comment out the "definition = index=mail" in default/macros.conf file. 4. Restart the Splunk server. For any other index except default main index, it might be worth trying below without any guarantee that it will work or not and instructions below are pure assumptions and not recommendations (so try at your own risk 🙂 😞 Try replacing references to mail index with yourNewIndex in the above two config files (and any other conf files where you see a reference of mail index). Thereafter you can ensure that corresponding directory of index is present under $SPLUNK_HOME\var\lib\splunk\yourNewIndex and restart Splunk server to see if it works out or not. ... View more

If its json then it shall already be extracted, but if not already extracted then you can extract them using below regex which will extract the values in fields called termField, msgField, ipField : your query to return events | rex field=_raw "Term\"\s*:\s*\"(?<termField>[^\"]+)\",\"Msg\"\s*:\s*\"(?<msgField>[^\"]+)\",\"Ip\"\s*:\s*\"(?<ipField>[^\"]+)\"" | table termField, msgField, ipField You can change the names of these fields if you like by changing it in above regex and same regex can be used in field extractor. ... View more

I beg to differ from @somesoni2 and @skoelpin as Logical OR looks wrong in the first part of the query syntax if intention is to exclude all four ports to show up in search: index="network" dport!=53 OR dport!=123 OR dport!=80 OR dport!=443 | iplocation src Since a Logical OR has been put in with a negation on the field value in above search, this search is only as good as searching index="network" | iplocation src Reason being whatever dport!=53 will negate to be searched, that will be included by all the other three negations (in fact any one other negation is sufficient). So ultimately not a single negation will work. If intention is not to search any of the four port mentioned then trying with AND shall make it achieve the intended result which shall look something like: index="network" dport!=53 AND dport!=123 AND dport!=80 AND dport!=443 | iplocation src ... View more

If each line is an individual event and your current extraction is working fine for all other users, then why don't you try to cut the "not required bit" at the source query by using NOT "for invalid" in the search string so that you don't get these results at all. ... View more

You shall ask these two questions: Do I want span between two data points of a timechart to adjust automatically? Am I OK with concatenating the status code and URL as a single field? If the answer to above two questions is yes then you shall use time chart as follows, where answer to second question is more important as timechart takes snigle by clause whereas span can always be controlled by using span= option within timechart command : index=XYZ environment=Production clientName="XYZClient" (statusCode!=200 AND statusCode!=-1) earliest=-24h | eval myfield= url."#".statusCode | timechart count by myfield Else you shall use chart command with bucketing _time first and then charting count over _time by url,statusCode , something like below to see if it works out to give the visualization you expect: index=XYZ environment=Production clientName="XYZClient" (statusCode!=200 AND statusCode!=-1) earliest=-24h | bucket _time span=1h | chart count over _time by url,statusCode ... View more

Hope this small story of a similar example of implementation helps which was as follows: There was Host A on which there was log file A and forwarder couldn't be installed on Host A . There was Host B on which Splunk was running. So to get the data from Host A to Host B Splunk , on Host B Splunk tcp input was configured to listen on port 12345 . Python script was asked to run on Host A to read log file A and when done reading, fire this output to Host B, port 12345 where Splunk will be waiting to receive it. The logs then stayed in Splunk index happily ever after. In your case if script cannot be put on Host A then there shall be an intermediate implementation which will first read the data from Host A (hardware) port xxxx and then forward it to Host B port 12345 where Splunk will be ready to receive. Choice of implementation shall be yours based on your environment, accessibility and security concerns. ... View more

Just a thought: How about the one's u want to keep as timeline milestone, keep them as bar charts and then overlay the one you want to keep as line on these bars. That will give the similar affect of having milestones standing lines (bars) and a line running through them (the value u overlayed). ... View more

You can display them in time hart like | timechart avg(responseTime) by appName Or maybe on uri. Explore with functions like min, max, avg etc in time chart. If you like you can represent pie chart of percentage of appName and so on... ... View more

If it's about really differentiating the terms from each other then one way can be of thinking it as , clustering to be within a layer like cluster of indexes , cluster of searchheads . Distributed can be one search head, one indexer, each on different machines. Technical details of each setup might have some overlaps, but that's the simplest I could think of 🙂 ... View more

If all you want is the response time for each app for a particular api url within a gien session id, then you can try this: your query to return event | rex "cf_app_name":"(?<appName>[^\"]+).+(GET|POST)\|(?<uri>[^\|]+)\|(?<sessionId>[^\|]+).+ResponseTime=(?<responseTime>[^\"]+).+timestamp\":(?<timestamp>[^}]+)" | table appName, uri, responseTime, sessionId, timestamp | sort sessionId, -timestamp ... View more

Did you add count in this line of SPL | fields percent,statusCode Unless you include field count in it to make it | fields count, percent,statusCode you will not be able to search on it in | search (statusCode="403" AND count>=100 AND percent > 2) ... View more

How do you expect a value of "Country" and "Value" to come in visualization? However if the question is "can one plot multiple series over year", yes you can do as follows: your query to return myYear and myValue | chart count(myValue), min(yourValue), max(everyOnesValue) over myYear ... View more

Try this please: your query to return the events | rex field=_raw "(?<method>(GET|POST))\s*(?<uri>[\S]+)\s*(?<protocol>(HTTP|\w+)\/[\S]+)\s*(.*?)(?<status>[\d]+)(\s|\s-\s)\d+\s*\d+\.\d+" | table method, uri, status Replaced \s with (\s|\s-\s) ... View more