Hello, I have a powershell Script that runs every day through my Filesystem and logs every Folder with all NTFS permissions. The output of the Script looks like this: example on pastebin Now I want to make a search with two dates and show the delta (new Folders) with all NTFS permissions. index=filesec |rex field=Path mode=sed "s/\\\/\//g" | table host, Path| search host="*" WER="*" (Path!="''" AND Path="*") NOT [search index=filesec earliest=-1d@d latest=@d host="*" WER="*" (Path!="''" AND Path="*") | fields host, Path | dedup host, Path | rex field=Path mode=sed "s/\\\/\//g" | table host, Path] | stats list(WER) as WER list(Rights) as Rights list(TYPE) as Type by Path This one works but only if there are less than 10000 Folders in the subsearch due to the default limit of 10000 (max 10500... splunk devs have a strange kind of humor i guess). I have about 15k Folders. Any suggestions how I can make it work? Every hint is appreciated! ... View more

Hello I'm using this Regex command: rex max_match=25 "\s+(?P<UserName>[^ ]+\s*\w*)\s+(?P<Status>[Allow|Deny]+)\s+(?P<Rigths>[\w+|-\d+][,\s+\w+]*)\n" with Version 6.2.x it works fine but after upgrade to 6.3 I get this error: Error in 'rex' command: Encountered the following error while compiling the regex '\s+(?P<UserName>[^ ]+\s*\w*)\s+(?P<Status>[Allow|Deny]+)\s+(?P<Rigths>[\w+|-\d+][,\s+\w+]*)\n': Regex: invalid range in character class Here a pastebin of sample data -paste- Am I the only one who is facing this? I hope you can help me. Best regards! ... View more