Another way is run this search index=_internal sourcetype=splunkd_conf data.asset_uri{}=savedsearches When any rule is changed the data.optype_desc field receive the WRITE_STANZA value. ... View more

You'll need to escape the double quote, like this: rex field="detail.output-cid-response" "\"firstName\":\"(?P<field_name>.*?)\"" or rex field="detail.output-cid-response" "\"firstName\":\"(?P<field_name>[^\"]+)" ... View more

Try this index=index_name | join type=left transaction_name [| inputlookup transaction.csv append=T | eval listed="true"] | where listed="true" The JOIN command put in your search result the field "listed" if the "transaction_name" value is in your lookup. ... View more

Did you try use one ony rex command? ... | rex field=_raw "(?P<field1>[^_])_(?P<field2>[^_])_(?P<field3>.*)" ... View more

If the user logged off from the host before login on the other? On this case you'll alert the both, or not? ... View more

try use rex field=_raw ... View more

If any event has two names on this field, better you use this: firstName\":\"(?P<cidFname>.*?)\" or firstName\":\"(?P<cidFname>[\w\s]+)\" ... View more

Hi, grijhwani I agree that the search still able to admin, but I think that felipecg want to hide how he detects some anomalies, like SQLi, XSS, Padding Oracle from other firm. I have a similar scenario here, 1 splunk and 2 rival companies to administrate, its a nightmare. ... View more