I am terrible with regexes. What regex would I need to extract "pdf" from the following? This was not pulling all events: ^(?:[^.\n]*.){3}(?P\w+) NCD-FSPW01,4,8646079,DFS-Groups,Passwords, \NCD-FSPW01\DFS-Groups\Legal\Corporate\Entities\Corporations\1. Terminated Corps\RE3, Inc\Board of Directors Meeting Minutes\2016-01-29 Board Meeting Minutes - RE3, Inc..pdf,1,,False NCD-FSPW01,4,8646079,DFS-IT,Passwords, \NCD-FSPW01\DFS-IT\Legal\Corporate\Entities\Corporations\1. Terminated Corps\RE3, Inc\Board of Directors - Meeting Minutes\2016-01-29 Board Meeting Minutes - RE3, Inc.pdf,1,,False NCD-FSPW01,4,9378690,DFS-Groups,Passwords, \NCD-FSPW01\DFS-Groups\Tax Dept\4 - REIT Tax Issues & Compliance\2. - Quarterly REIT Tests\2015\Q4\Baby REIT\Sent for Board\Board Approvals\2016-01-29 Board Meeting Minutes - RE33, Inc..pdf,1,,False NCD-FSPW01,4,9378690,DFS-IT,Passwords, \NCD-FSPW01\DFS-IT\Tax Dept\4 - REIT Tax Issues & Compliance\2 - Quarterly REIT Tests\2015\Q4\Baby REIT\Sent for Board\Board Approvals\2016-01-29 Board Meeting Minutes - RE34, Inc.pdf,1,,False Thanks! ... View more

I know this topic has been addressed many times on here but I cannot get my xml events to break properly. I am retrieving Cisco Prime devices via REST API xml call. Designating the TA_cisco_ios addon as the App in REST, I just cannot get it broken into individual events. Splunk just shows 1 event as seen attached xml-file. My props.conf under TA_cisco_ios looks like: [cisco:ios] BREAK_ONLY_BEFORE= TRUNCATE=500000 My REST setup looks like this: REST API Input: Cisco Prime Device Status Endpoint URL: https://172.x.x.85/webacs/api/v3/data/Devices.xml?.full=true Authentication Type: basic Sourcetype: cisco:ios App: TA-cisco_ios Status: Enabled Thanks in advance! This is driving me crazy! ... View more

I have a field PP that I would like to use in eval statement to get a percentage from JSON data and using spath. Here is the search: index=main sourcetype=knowbe4 | head 1 | spath input=_raw path="{}.name" output=Campaign | spath input=_raw path="{}.status" output=Status | spath input=_raw path="{}.started_at" output=Started | spath input=_raw path="{}.duration" output=Duration | spath input=_raw path="{}.scheduled_count" output=Recipients | spath input=_raw path="{}.delivered_count" output=Delivered | spath input=_raw path="{}.clicked_count" output=Clicked | spath input=_raw path="{}.attachment_open_count" output="AttachOpen" | spath input=_raw path="{}.reported_count" output=Reported | spath input=_raw path="{}.phish_prone_percentage" output=PP| convert num(PP) as PPP | eval perc=(PP * 100) | table Campaign Status Started Duration Recipients Delivered Clicked "Attachment Open" Reported PP perc PPP I have values for PP and PPP but no value (null) for perc. Table results: Campaign Status Started Duration Recipients Delivered Clicked AttachOpen Reported PP perc PPP 2018 W-2 Active 2/13/18 4 1657 1401 141 0 140 .17 .17 ... View more

I have an instance using ServiceNow data where I want to dedup the data based on sys_updated_on to get the last update and status of the incident. sourcetype="snow:pm_project" | dedup number sortby -sys_updated_on However, I keep getting "|" pipes are not allowed. I started looking at modifying the data model json file, but still got the message. I might note that I am using "Root Event" to get acceleration to work with this. I know I can do searches to use dedup. Should I use "Root Search" and "Root Event" together? Not sure how I would do that. This is the search I ultimately want: sourcetype="snow:pm_project" | dedup number sortby -sys_updated_on | search state=-5 where state would be child objects beneath the base search. Any help would be appreciated.....I have spent a lot of time banging my head on this and want to use data models for acceleration. ... View more