I am trying to use the rex command to extract an id number, which is a mixture of letters and numbers separated by a dash. For example, one of the ids looks like this: 34gv564-3333-5tg4-gt53-4rgt5eg5g35gb The field itself is as follows: MFA challenge succeeded for account aaaaaaaaa with email example@example.co.uk. Session id is 34gv564-3333-5tg4-gt53-4rgt5eg5g35gb The rex command I'm using is as follows:   | rex "(?i) is (?<id_number>[^\"]+)"   The only problem is that sometimes it extracts the email address bit too Any help would be greatly appreciated ... View more

I have a pie chart displaying the top 10 ip address for the past 60 minutes, and I'm trying to figure out how to then be able to click that bit of the pie chart, to then open a new window relevant information about that specific ip address instead of all the IP addresses in the pie chart ... View more

So I've got a dashboard about failed login attempts and I want to have a searchable function as well. The searchable function will have four separate search boxes, which will be "Username", "User ID", "Email Address" and "IP Address". I want it to so that when you search for the username in the username search box, it will retrieve the Username in the username tile, User ID in the user id tile, Email Address in the email address tile and IP Address in the ip address tile. Likewise if you were to search for any of those other things it would return all those results. Just as a note, the username can be either an email address or a string of numbers and letter My code looks like this so far: IP Address Tile:   index=keycloak ipAddress=$ipaddress$ | table ipAddress     Username Tile:    index=keycloak username=$username$ AND username!="*@*" | dedup userId | fields username | table username     Any help with this would be great ... View more

So I'm trying to install an app on Splunk Cloud and it went through the checks and it failed due to the following error: Detected an outdated version of the Splunk SDK for Python (1.6.15). Please upgrade to version 1.6.16 or later. File: bin/splunklib/binding.py Does anyone know how to upgrade the Splunk SDK for Python on Splunk Cloud? ... View more

Does anyone have any experience using the IP Quality Score add-on in Splunk? I've been given very little information on how to actually run searches in the add-on and so far im not getting any results. For instance I'm trying to use the IP Detection commands on our web traffic logs but I'm not getting any results. I just keep getting an error saying:   Exception at "/opt/splunk/etc/apps/TA-ipqualityscore/bin/ipdetection.py", line 127 : There are no events with ip field.     ... View more

As the titles suggests, we are planning on migrating our heavy forwarder to a separate VLAN. However this is the first time I've done anything like this, and I was wondering what things I need to consider. If anyone can help that would be great ... View more

So I'm trying to extract a field called "secureToken=tokenvalue" from our akamai logs. However when I try to extract the field, it gives me the following error message: The extraction failed. If you are extracting multiple fields, try removing one or more fields. Start with extractions that are embedded within longer text strings. I have attempted to manually edit the regex, but I have not a lot of experience with regex so any help would be greatly appreciated  Thanks ... View more

I'm sorting through web traffic and I'm trying to extract what device users are using from the user agent. However, when I have highlighted the device and check the preview, it has highlighted some different devices like Windows, Macintosh, Linux.  But it has also highlighted a lot of random strings of text that definitely aren't devices, and when I've looked through these, I can clearly see the device in that user agent that hasn't been highlighted. Is there a way to make sure devices are being highlighted to be extracted and now random strings of text etc? ... View more