Please tell us more about what you don't understand about the command.  What part of the documentation is unclear? ... View more

Assuming you set INDEXED_EXTRACTIONS = csv then TIMESTAMP_FIELDS is what you should use.  However, you also will need TIME_FORMAT.  The value of TIME_FORMAT depends on how we should interpret the example content.  Is "10.Hour" literal text or some representation of time of day?  If the former then is there another field with time of day in it?  If there is no time information then use this setting TIME_FORMAT = 10.Hour %b %d, %Y ... View more

This should do, at least with the sample event. | rex "target service (?<targetService>[^,]+), the account (?<account>\S+)" ... View more

This should get you started. <<your search>> | rex "Status: (?<log_level>\w+)" | stats count by log_level ... View more

If your problem is resolved, then please click the "Accept as Solution" button to help future readers. ... View more

Maybe this run-anywhere example will get you started. | makeresults | eval _raw="<entry key=\"memberOf\"> <value> <Map> <entry key=\"CN=Buttercup Location - Group,OU=SharePoint,OU=Groups,DC=corp,DC=buttercup,DC=com\"/> <entry key=\"CN=Contractors - Group,OU=SharePoint,OU=Groups,DC=corp,DC=buttercup,DC=com\"/> <entry key=\"CN=Contractors – Buttercup - Group,OU=MIM Created Groups,OU=Groups,DC=corp,DC=buttercup,DC=com\"/> <entry key=\"CN=Contractors – US – Buttercup - Group,OU=MIM Created Groups,OU=Groups,DC=corp,DC=Buttercup,DC=com\"/> <entry key=\"CN=Corp-Hypr,OU=Hypr,OU=Groups,DC=corp,DC=Buttercup,DC=com\"/> <entry key=\"CN=Everyone - Group,OU=SharePoint,OU=Groups,DC=corp,DC=Buttercup,DC=com\"/> <entry key=\"CN=Everyone - Buttercup - Group,OU=MIM Created Groups,OU=Groups,DC=corp,DC=Buttercup,DC=com\"/> <entry key=\"CN=O365-Buttercup2,OU=MIM Created Groups,OU=Groups,DC=corp,DC=Buttercup,DC=com\"/> <entry key=\"CN=Buttercup ,OU=SAP Service Accounts and Groups,OU=Service Accounts,DC=corp,DC=Buttercup,DC=com\"/> <entry key=\"CN=Buttercup-MNOPQ,OU=CIT-WS,OU=Groups,DC=corp,DC=Buttercup,DC=com\"/> </Map> </value> </entry>" ``` Above is demo data. Delete IRL. ``` | spath output=Map path=entry.value.Map | spath input=Map output=values path=entry{@key} | eval key="memberOf" | table key values ... View more

Excess data probably is the result of someone adding or enabling entries in inputs.conf files.  There are other changes that could do it, but inputs.conf is the main one. Detecting changes can be tricky.  I know of at least one customer that has a monitor:// stanza for all of their .conf files so changes are in Splunk and can be alerted.  There's also the _configtracker feature in Splunk 9 that may be of use. ... View more

If the add-on provides the same data as syslog then you don't need both of them. ... View more

So the Upgrade Readiness App lied.  Sorry about that. Also, I believe you'll find the SA_ldapsearch app is not supported by Splunk Cloud. ... View more

The best place from which to get an app config is the Splunk app store (apps.splunk.com).  Also, any non-cloud Splunk UI can generate an app for you by clicking the New button on the Manage Apps page.  Finally, you can create the structure yourself using an existing app as a guide and the docs at https://dev.splunk.com/enterprise/tutorials/module_getstarted/createapp ... View more

Yes, apps and add-ons must be installed after running the .msi file.  They can be installed using a splunk.exe command or my manually expanding the .spl file into the proper place (%SPLUNK_HOME%\etc\apps). Add-ons typically need to be installed on UFs (for the inputs.conf settings) as well as on the indexers and search heads (for props.conf and other settings). Sometimes the documentation assumes other steps have been taken previously.  I'm not familiar with the switches you mentioned, but they may be part of an add-on you have not yet installed. You do not *need* a DS, but it is highly recommended you use one, unless your company has another method for managing the software installed on endpoints. ... View more

The extract command will handle the case where all values are separated by the same set of delimiters.  | extract pairdelim=";" kvdelim="=" That is not the case in your example data, however.  Only the message field has those delimiters and the extract command only works on _raw.  That's why I used rex, instead. ... View more

When table fields are blank it's almost always because the field is null (other times it's an empty string).  In this case, the fields are null because the rex commands don't match the data and because 2 fields in the table command are not extracted.  When creating regular expressions for the rex command, spaces and case are very significant. Try this query index="test RequestId RequestStatus | rex "RequestStatus=(?<RequestStatus>\w+)" | rex "RequestId=(?<RequestID>[^;]*)" | rex "PlatformBuckets=(?<PlatformBuckets>[^;]+)" | rex "ResponseStatusCode=(?<ResponseStatusCode>\d+)" | table RequestStatus, RequestID,PlatformBuckets,ResponseStatusCode _time   ... View more

What are you trying to accomplish by sending the same data to two indexes?  Once we understand that we can offer suggestions. ... View more

It's not clear to me what it is you wish to delete.  There is no uploaded file on Splunk so there's nothing to delete.  The original file on your workstation is not touched, other than to read it.  Once the data is ingested, you can safely delete the original data. If you want Splunk to automatically delete a monitored file after it has been indexed, use a batch input.  See https://docs.splunk.com/Documentation/Splunk/9.0.4/Admin/Inputsconf#:~:text=setting%20also%20exists.-,BATCH,-(%22Upload%20a%20file for details. ... View more

I have to disagree with @gcusello on two points. First, it's not necessary to manually install the UF on Windows.  There is a CLI method designed, in part, for use with automation.  See https://docs.splunk.com/Documentation/Splunk/9.0.4/Installation/InstallonWindowsviathecommandline#Install_Splunk_Enterprise_from_the_command_line Second, it's better to not use intermediate forwarders (IFs) at all.  The reason about fewer firewall holes must have been created by a lazy firewall admin.  IFs add complexity and failure points.  Where possible, UFs should send directly to Splunk Cloud. If you do use IFs, I completely agree that you should have at least two of them. ... View more