@rahul_acc_splunk2 try this, 1) index=pan_logs src_ip=xxxxx machine_name=xxxxx | appendcols [search index=AD src_ip=xxxxx machine_name=xxxx | table account_name | fields account_name ] | table src_ip machine_name account_name check below link, http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Appendcols 2) index=pan_logs OR index=AD | table src_ip machine_name account_name | stats values(account_name) as account_name by src_ip machine_name i believe src_ip, machine_name and account_name fields are extracted. Go through below link ... View more

@mlprasad79 try this, your search | rex field=_raw "[\S+\s+]\s(?P<end_time>\d+-\d+-\d+\s\d+:\d+:\d+\,\d+)\s+-\s+.+(?P<MainFlowOUT>MainflowOUT)" | rex field=_raw "[\S+\s+]\s(?P<begin_time>\d+-\d+-\d+\s\d+:\d+:\d+\,\d+)\s+-\s+.+(?P<MainFlowIN>MainflowIN)" ... View more

@C_HIEN check that filename and source field have same value. If so you can extract by using regex or field extraction 1) rex field=source "/tmp/filename-(?<fileyear>\d+)" 2) props.conf EXTRACT-fileyear = /tmp/filename-(?<fileyear>\d+) in source ... View more

try this your search | eval UserName= replace(UserName,".",". ") ... View more

<form> <label>titletoken</label> <fieldset submitButton="false"> <input type="multiselect" searchWhenChanged="true" token="region"> <label>Region</label> <prefix>(</prefix> <suffix>)</suffix> <valuePrefix>Region="</valuePrefix> <valueSuffix>"</valueSuffix> <delimiter> OR </delimiter> <choice value="*">All</choice> <choice value="ASIA">ASIA</choice> <choice value="EUROPE">EUROPE</choice> <choice value="IMEA">IMEA</choice> <choice value="NORTH AMERICA">NORTH AMERICA</choice> <choice value="LATIN AMERICA">LATIN AMERICA</choice> <choice value="UNKNOWN">UNKNOWN</choice> <default>*</default> <initialValue>*</initialValue> </input> </fieldset> <row> <panel> <title>$region$</title> <event> <search> <query>index=_internal |head 1</query> <earliest>-15m</earliest> <latest>now</latest> </search> </event> </panel> </row> </form> ... View more

@kiran331 your search | rex field=_raw "Password:\s+(?P<password>.+)\s+TPM: ... View more

@haja4nhn try this, you base query or search | rex field=_raw "\d+\/\d+\/\d+\s+\d+:\d+:\d+\s+\S+\s+\d+.\d+\s+\d+\s+(?P<field6>\d+.\d+)" ... View more

@ddrillic create a user role in authorize.conf with proper capabilites. Map the user role with the proper AD group (you belongs to ) in authentication.conf . optional: you can add this splreadaccess_user in default.meta. Because your role has inherited user and power role. so that you can read all apps. for e.g, authorize.conf [role_splreadaccess_user] cumulativeRTSrchJobsQuota = 0 cumulativeSrchJobsQuota = 0 importRoles = power;user srchIndexesAllowed = * srchIndexesDefault = * srchMaxTime = 0 use_file_operator = enabled authentication.conf splreadaccess_user = adgroup1 ... View more

i guess capture group is not necessary .. whenever it finds &lt;VULN it will break the event from there ... View more

@sphc try this in props.conf, [yoursourcetype] LINE_BREAKER = &lt;VULN DATETIME_CONFIG = KV_MODE = xml NO_BINARY_CHECK = true category = Custom pulldown_type = true SHOULD_LINEMERGE = false ... View more

@nagaraju_chittathuru That error is because, splunk should have already extracted the value and put it some field. So thatt you can't create new field out of it. To resolve this issue, on top right corner on your IFX screen there is drop down button named existing fields.Click on that uncheck the fields and try to extract your required field. i hope it helps ... View more

@Gaya852635 try this in props.conf [json_embedded] REGEX = "(\w+)"."(\S+?)" FORMAT = $1::$2 ... View more

@jfunderburg Please run your query on smart mode or verbose mode not on fast mode. ... View more

can you please paste complete search query. ... View more

execute below steps first and MC to setup labels, Log into the instance on which you want to configure the Monitoring Console. In Splunk Web, select Settings > Distributed search > Search peers. Click New. Fill in the requested fields and click Save. Repeat steps 3 and 4 for all instances ... View more

@SridharS please try below, | transaction SERVERNAME startswith=eval(match(SUMMARY,“SERVER DOWN_\w+”)) endswith=eval(match(SUMMARY,“SERVER UP_\w+”)) keepevicted=true maxspan=28d | eval StartTime=_time | eval EndTime=_time+duration | eval "Session Length"=tostring(duration, "duration")| streamstats window=1 current=f last(StartTime) as next_starttime | eval delta=next_starttime-StartTime | eval "StartTime"= strftime(StartTime, "%m/%d/%y %H:%M:%S") | eval "EndTime"=strftime(EndTime, "%m/%d/%y %H:%M:%S") I hope it helps ... View more

Can you please try like below, props.conf [yoursourcetype] BREAK_ONLY_BEFORE = &lt;VULN DATETIME_CONFIG = KV_MODE = xml NO_BINARY_CHECK = true category = Custom pulldown_type = true ... View more

@mstark31 check this, | makeresults | eval test="Thing1 / Thing2" | eval test1 = case(test=="Thing1 / Thing2","One",test!="Thing1 / Thing2","Two") | eval test2 = case(test="Thing1 \/ Thing2","one",test!="Thing1 \/ Thing2","TWO") ... View more

@Roozbeh59 You can't add or attach image to your email body through Splunk GUI. But can achieve it by sendemail.py.and the file will be available under this location $SPLUNK_HOME$/etc/apps/search/bin ... View more

https://regex101.com/r/FPxKuU/1 or | makeresults | eval test="10.10.2017 09:40:39.651 INFO [10.86.208.119 [1507646439651] POST /apps/xxxx/yyyy HTTP/1.1] com.xxxx.yyyy.api.impl.logging.info.InfoLoggerServiceImpl {\"id\":{\"access_token\":\"7ee2ea18-e72c-449d-9dec-28d02b116c92\",\"uid\":\"zzzzz\",\"jsessionID\":\"aaaaaaa\",\"uuid\":\"12e255ac-35e9-4630-a36b-89aa27e9566e\"},\"request\":{\"url\":\"https://bbb.cccc.com/content/uuuuuu\"..... }]}}" | rex field=test "(?P\"(\w+)\".\"(\S+))\"" ... View more

@twjack try this, | inputlookup something.csv | eval Host_Application=replace(Host_Application,"\*","#") | rest of your search ... View more

@ByteFlinger Please check below splunk answer it might help you, https://answers.splunk.com/answers/10265/change-default-web-ui-locale.html https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/AdvancedDev/TranslateSplunk or go to this location, $SPLUNK_HOME$/lib/python2.7/site-packages/splunk/appserver/mrsparkle/locale 1) make sure en_GB is present. 2) tar en_US 3) Delete en_US ... View more