just wondering why you want rex mode=sed, maybe, just a regular rex field extraction is enough.. just a thought - Interesting_String_Value | top 10 field19 | rex field=_raw "actual-field-description="(?<actual_value>[maybe \w+ \d+])" updated from Sundaresh Sir's comment - Interesting_String_Value | top 10 field19 | rex field=field19 "\"(?<field19>[^\"]+)\"" ... View more

try this one - | tstats count WHERE index=* by sourcetype _time or, main* is required, then | tstats count WHERE index=main* by sourcetype _time ... View more

i hope, with enterprise trial license you can configure SHC and index cluster. Summary of key requirements for search head clusters These are the main issues to note regarding provisioning of cluster members: Each member must run on its own machine or virtual machine, and all machines must run the same operating system. All members must run on the same version of Splunk Enterprise. All members must be connected over a high-speed network. You must deploy at least as many members as either the replication factor or three, whichever is greater. In addition to the cluster members, you need a deployer to distribute updates to the members. The deployer must run on a non-member instance. In some cases, it can run on the same instance as a deployment server or an indexer cluster master node. There is no special type of license specifically for search heads, that is to say, there is no "Search head license". However, you must have an Enterprise license to configure a search head. http://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/TypesofSplunklicenses http://docs.splunk.com/Documentation/Splunk/6.4.2/DistSearch/SHCsystemrequirements maybe, you should check "Sales trial license" If you are working with Splunk Sales, you can request trial Enterprise licenses of varying size and duration. The Enterprise trial license expires 60 days after you start using Splunk. If you are preparing a pilot for a large deployment and have requirements for a longer duration or higher indexing volumes during your trial, contact Splunk Sales or your sales rep directly with your request. ... View more

index=_audit tag=authentication | stats count by user, info | sort - info this works fine, but it includes LDAP as well. let me check how to get only local accounts. one more question - do you have both Local accounts and LDAP authentication together ah?!?! ... View more

when you create the alert, you can enable "Add to Triggered Alerts" action, so that, you can review all recently triggered alerts on the Triggered Alerts page. http://docs.splunk.com/Documentation/Splunk/6.4.2/Alert/Triggeredalertaction http://docs.splunk.com/Documentation/Splunk/6.4.2/Alert/Reviewtriggeredalerts Details of triggered alerts are available for 24 hours by default. updated - this query will give us a list of alerts fired in last 1day - index=_audit action=alert_fired earliest=-1d@d ... View more