Hi, I wonder whether someone may be able to help me please. I've put together the following regex to extract the address line from the data below. "\"lines\":\[\"(?<idaAddress>[^\"]+)" Field Data {"matchingDataset":{"surnames":[{"value":"Smith","verified":true}],"gender":{"value":"MALE","verified":true},"dateOfBirth":{"value":"1973-12-26","verified":true},"firstName":{"value":"John","verified":true},"addresses":[{"verified":true,"postCode":"AB1 1BC","lines":["1 A Street","A Town","GB"]}],"middleNames":{"value":"john","verified":true}},"hashedPid":"123","matchId":"_123","levelOfAssurance":"LEVEL_2"} The problem I have is that it is only extracting the first part of the address, i.e. in the above "1 A Street" where as I would like to extract "1 A Street, A Town, GB". I'm sure that it's the back of the query which needs to change but despite trying I'm a little unsure about how to solve this. I just wondered whether someone may be able to look at this please and offer some guidance on how I can go about this. Many thanks and kindest regards Chris ... View more

Hi, I wonder whether someone may be able to help me please. I'm using the search below to produce data in the following format First Name Surname DOB NINO SUT auditSource="matching" auditType="Tx*" detail.input-ida-request="*" | rex field="detail.output-cid-response" "\"firstName\":\"(?<cidFName>[^\"]+)" | rex field="detail.output-cid-response" "\"lastName\":\"(?<cidSName>[^\"]+)" |rex field="detail.output-cid-response" "\"dateOfBirth\":\"(?<cidDOB>[^\"]+)" | rex field="detail.output-cid-response" "\"sut\":\"(?<cidSUT>[^\"]+)" | rex field="detail.output-cid-response" "\"nino\":\"(?<cidNINO>[^\"]+)" | eval Full_Details= "Firstname: ".cidFName.", Surname: ".cidSName.", DOB: ".cidDOB.", NINO: ".cidNINO.", SUT: ".cidSUT | makemv delim=", " Full_Details | table detail.output-cid-response Full_Details The problem I have is that if there is one piece of information missing from the source data, the whole list fails to display. Could someone tell me please, is there a way to overcome this? Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone could help me please. I'm trying to put together a rex to extract the First Name from the data below. {"matchingDataset":{"surnames":[{"value":"Smith","verified":true}],"gender":{"value":"MALE","verified":true},"dateOfBirth":{"value":"1973-12-26","verified":true},"firstName":{"value":"John","verified":true},"addresses":[{"verified":true,"postCode":"AB1 1BC","lines":["1 A Street","A Town","GB"]}],"middleNames":{"value":"john","verified":true}},"hashedPid":"123","matchId":"_123","levelOfAssurance":"LEVEL_2"} From guidance I received from a post I made here I've been trying to come up with a suitable solution as shown below. "\"firstName\":\"{\"\"value\":\"(?<idaFName>[^\"]+)" Unfortunately, although I'm not receiving any error message, I'm not able to extract the information I need. I've tried using Regex101 yesterday afternoon and this morning without success, but I admit I am a complete novice when it comes to regex. I just wondered whether someone could look at this please and let me know where I've gone wrong. Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone could help me please. I have a field called detail.cid-repsonse which looks like the following: [{"name":{"current":{"firstName":"JOHN","lastName":"SMITH"}},"ids":{"sut":"1234567890","nino":"AA111111A"},"dateOfBirth":"26121973"}] From this I need to create new fields and extract the following data: First Name Last Name Sut NINO DOB I just wondered whether someone may be able to offer some guidance on how I may go about this please. Any help would be greatly appreciated. Many thanks and kind regards Chris ... View more

Hi, I wonder whether someone may be able to help me please. I'm using the following searches: Search 1 - "EI Auth" Auth - index="main" auditSource=*auth* auditType=LoginEntitlements detail.Ref=* | stats count by detail.Ref | rename detail.Ref AS REF *Search 2 - "EI Microservice" * MicroService - auditSource="ei-microservice" detail.StatusCode="*" | stats count by detail.ERef | rename detail.ERef AS REF What I'm trying to do is join the two using the field REF, but despite looking at the tutorial on the Splunk documentation and receiving help here I've still been unable the join the two. Could someone perhaps show me please how I can join the two searches, and could you also confirm for me please whether I have to run the two searches separately before running the 'Join' search? Many thanks and kind regards Chris ... View more