Hi SplunkUser5888, somehting like this should get you started: YourBaseSearchHere | rex field="_raw" "'(?<myDest>.+)'\:\s\('(?<myFound>.+)'\,\s'(?<myVirus>.+)'" | table myDest, myFound, myVirus this will create a table of three fields for you: myDest=C:\\Users\\User\\Downloads\\pyClamd-0.3.4\\SplunkClam\\Virus_zip_pass\\Virus.zip myFound=FOUND myVirus=Eicar-Test-Signature-1 cheers, MuS ... View more

Hi ehoward, like lukejadamec said sample data are most useful and your needs as well. Nevertheless since arpwatch is nothing else then syslog output and therefore pretty generic you can do some regex-Fu based on this log example: Nov 10 15:59:34 debian arpwatch: new station 192.168.1.2 0:17:9a:a:f6:44 eth0 Nov 10 15:59:34 debian arpwatch: changed station 192.168.1.2 0:17:9a:b:f6:f6 (0:17:9a:a:f6:44) Nov 10 15:59:34 debian arpwatch: new station 192.168.1.2 0:17:9a:a:f6:44 eth0 Nov 10 15:59:34 debian arpwatch: changed station 192.168.1.2 0:17:9a:b:f6:f6 (0:17:9a:a:f6:44) Nov 10 15:59:34 debian arpwatch: new station 192.168.1.2 0:17:9a:a:f6:44 eth0 Nov 10 15:59:34 debian arpwatch: changed station 192.168.1.2 0:17:9a:b:f6:f6 (0:17:9a:a:f6:44) using above sample use this: ... | rex field="_raw" "\:\s(?<arpwatchStatus>.+station)" | ... to get a new field arpwatchStatus containing either new station or changed station . Use this : ... | rex field="_raw" "\s(?<arpwatchInterface>[a-z]+[0-9])" | ... to get a new field called arpwatchInterface containing in this case eth0 . You just learned search time field extraction, so you should know what the field names for the next examples will be and what they will contain: ... | rex field="_raw" "new\sstation\s(?<arpwatchNewIP>(\d+\.){3}\d+)\s" | ... ... | rex field="_raw" "new\sstation\s(\d+\.){3}\d+\s(?<arpwatchNewMAC>([0-9a-f]{1,2}[\.:-]){5}([0-9a-f]{1,2}))" | ... ... | rex field="_raw" "changed\sstation\s(?<arpwatchChangedIP>(\d+\.){3}\d+)\s" | ... ... | rex field="_raw" "changed\sstation\s(\d+\.){3}\d+\s(?<arpwatchChangedMAC>([0-9a-f]{1,2}[\.:-]){5}([0-9a-f]{1,2}))" | ... field extraction can be setup to happen automatic, take a look at the docs about this. hope this helps to get you going ... cheers, MuS PS: if this answer was useful, please tick the tick to mark it answered ... View more

Hi FloydATC, take a look at this wiki article about where do I configure my Splunk settings, this is a good starting point to learn where you should configure settings. As you are configuring searching stuff, this will be on the indexer or a search head if you have one. Also change only one option/stanza at a time, don't forget to | extract reload=t (this reload props and transforms) or restart splunk and check the result and continue after that. Some changes in transforms.conf like LOOKAHEAD, DEST_KEY, WRITE_META, DEFAULT_VALUE, REPEAT_MATCH will only apply to new data/events not your old/already indexed events. But since you set DELIMS and FIELDS which are search operators this will be used for all data. If you feel completely lost, remove everything and start with new empty/fresh props.conf and transforms.conf. hope this helps to get you going ... cheers, MuS ... View more