Hi, I wonder whether someone may be able to help me please. I've put together the following search which: For each detail.referenceNumber, Check to see whether it has the auditType "Form Saved" and, Not the auditType "FormSubmission". If these apply extract the information using the latest event for the "detail.referenceNumber" index=main auditSource=for-frontend auditType=FormSaved | eval generatedAt=strptime(generatedAt, "%Y-%m-%dT%H:%M:%S")|convert timeformat="%d/%b/%Y %H:%M" ctime(generatedAt) | rename generatedAt As "submissiondate" | rename detail.name As "fullname" | head 1 | table submissiondate detail.referenceNumber | search NOT[search index=main auditSource=for-frontend auditType=FormSubmission | table submissiondate detail.referenceNumber] The search works well, but I am now wanting to adapt this and amalgamate multiple fields into one, so I have put together the following: index=main auditSource=for-frontend auditType=FormSaved | eval generatedAt=strptime(generatedAt, "%Y-%m-%dT%H:%M:%S")|convert timeformat="%d/%b/%Y %H:%M" ctime(generatedAt) | rename generatedAt As "submissiondate" | rename detail.name As "fullname" | rename detail.referenceNumber As "refno" | head 1 | eval Full_Details= "Ref No: ".refno.", Fullname: ".fullname.", Date and Time of submission: ".submissiondate | makemv delim=", " Full_Details | table Full_Details | search NOT[search index=main auditSource=for-frontend auditType=FormSubmission | table Full_Details] The problem I have is that when I run this search, it is extracting those submissions with an auditType of "FormSubmission" which it shouldn't and I've no idea why. Could someone have a look at this please and let me know where I've gone wrong. Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone may be able to help me please. I'm trying to put together a search which extracts records in Splunk which are greater than 30 days from the current date using the field generatedAt as the field whereby to calculate the 30 days. Using a post I found here I've put together the following search: index=main auditSource=for-frontend auditType=FormSaved | eval epochevent=strptime(generatedAt, "%Y/%m/%d") | eval epoch30daysago=relative_time(now(), "-30d@d" ) | where epoch30daysago>=epochevent | table detail.referenceNumber | search NOT[search index=main auditSource=for-frontend auditType=FormSubmission] The search runs and correctly doesn't display any events, but to test this, I used the time period as 1 hour because I've entered some test submissions within this time period, but the search still isn't returning any events. Could someone possibly look at this please and offer some guidance on where I've gone wrong? Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone may be able to help me please: I'm trying to return the following details: Submission Date Reference Number With the following criteria: Where the reference number has an auditType=FormSaved but does not have the auditType=FormSubmission (Because it is possible to have both auditTypes for the same reference number) this is what I've put together so far, but I just can't get this to work. index=main auditSource=for-frontend auditType=FormSaved | eval generatedAt=strptime(generatedAt, "%Y-%m-%dT%H:%M:%S")|convert timeformat="%d/%b/%Y %H:%M" ctime(generatedAt) | rename generatedAt As "submissiondate" | table submissiondate detail.referenceNumber | join type=left detail.referenceNumber[search index=main auditSource=for-frontend NOT auditType=FormSubmission | eval generatedAt=strptime(generatedAt, "%Y-%m-%dT%H:%M:%S")|convert timeformat="%d/%b/%Y %H:%M" ctime(generatedAt) | rename generatedAt As "submissiondate" | table submissiondate detail.referenceNumber] I just wondered whether someone could look at this please and let me know where I've gone wrong. Many thanks and kind regards ... View more

I wonder whether someone may be able to help me please. I'm trying to extract the text "Comapred to previous years almost a pleasure to use" from the raw data as shown below feedback-comments=Compared+to+previous+years+almost+a+pleasure+to+use&isJavascript I've tried the following regex, which does extract the text but this includes the '+' sign. feedback-comments=(?<comments>[^[]+)\&isJavascript Could someone possibly tell me please how I would be able to write this so the '+' signs are excluded. Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone may be able to help me please. I've created this regex \"Surname\\":\\"(?&lt;SName&gt;[^"]+)\\" which extracts the Surname from the following raw data: "Surname\":\"SMITH\" This works fine in Regex101, but I when I add this to my query here: auditSource=tamc auditType=OutboundCall | rex field=_raw "\"Surname\\":\\"(?<SName>[^"]+)\\"" I receive the following error: Mismatched ']'. I just wondered whether someone may be able to look at this please and let me know where I've gone wrong. Many thanks and kind regards Chris ... View more