@kamlesh_vaghela below is the sample raw event {"event": {"event_type": "Threat Detected", "timestamp_nanoseconds": 543000000, "date": "2018-10-29T12:20:53+00:00", "file": {"disposition": "Malicious", "identity": {"md5": "44d88612fea8a8f36de82e1278abb02f", "sha1": "3395856ce81f2b7382dee72602f798b642f14140", "sha256": "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f"}, "file_name": "f9ab116c-40f5-40db-a566-4d3d948587c3.tmp", "file_path": "\\?\C:\Users\User.Name\Downloads\f9ab116c-40f5-40db-a566-4d3d948587c3.tmp", "parent": {"disposition": "Clean", "identity": {"md5": "f8ba54ad76c8f8ec9f3d639871b30f27", "sha1": "d42ea42b362442299195a82cfb998f10b11af868", "sha256": "c0edc58682b6fa296a439da2320c8bf74d7bf5f8e83446441048687beb60a472"}, "file_name": "chrome.exe", "process_id": 13132}}, "computer": {"links": {"trajectory": "https://api.eu.amp.cisco.com", "computer": "https://api.eu.amp.cisco.com", "group": "https://api.eu.amp.cisco.com"}, "connector_guid": "ec10a6ba-1bf2-42d8-8254-77fbcea54c6a", "active": true, "hostname": "Demo-PC-001", "user": "firstName.LastName@Domain.com", "external_ip": "xxx.xxx.xxx.xxx", "network_addresses": [{"ip": "xxx.xxx.xxx.xxx", "mac": "xx:xx:xx:xx:xx:xx"}, {"ip": "xxx.xxx.xxx.xxx", "mac": "xx:xx:xx:xx:xx:xx"}, {"ip": "xxx.xxx.xxx.xxx", "mac": "xx:xx:xx:xx:xx:xx"}, {"ip": "xxx.xxx.xxx.xxx", "mac": "xx:xx:xx:xx:xx:xx"}]}, "id": 6617752838799884295, "timestamp": 1540815653, "connector_guid": "asas-weuwuey-kjhdfkjaf", "event_type_id": 1090519054, "detection": "Win.Trojan.EICAR-Test-File", "detection_id": "6617752838799884292", "group_guids": ["272362aashasah13276237623jsdhjsdjsh"]}} ... View more

hi @kamlesh_vaghela Thank you for the quick response. in the raw log has following "user": "firstName.LastName@DomainName.com" ... View more

@renjith.nair thank you for the prompt response. did i use the correct way to create the field extraction ? is there anything need to be added ? i tried to save this as a field extraction in Settings > Fields > Filed Extraction. below are the settings for this extraction Destination App: Search Name: User_field_extract Sourcetype: SourceTypeName Type: inline Extraction and Transform: rex field=userId "(?.+?(?=@))" App Permission: Global Thank you very much. ... View more

@renjith.nair wow. that work like a charm. thank you very much. this regex work fine when i run in the search bar. i can see the field getting extracted. but how can i save this extraction permanently ? i tried to save this as a field extraction in Settings > Fields > Filed Extraction. below are the settings for this extraction Destination App: Search Name: User_field_extract Sourcetype: SourceTypeName Type: inline Extraction and Transform: rex field=userId "(?<user>.+?(?=@))" App Permission: Global in the search bar, i can get the extracted field when i search with index name index=asa | rex field=userId "(?<user>.+?(?=@))" but it doesn't return any results when i search with the sourcetype, source or host. any idea wht might be the reason ? Thank you very much Renjith. NOTE: i am using your exact regex command given in your answers. Regards Irosha ... View more

Hi @renjith.nair the regex worked fine in my search. apparently , we have few few naming conventions. some are just firstname@domain.com. can you help me to create a regex that detect "everything" before @ sign ? Thank you very much. ... View more

Hi Renjith, Thank you very much for the quick response. will you be able to tell me how to create the field adding this this please ? i am quite new to splunk Thank you 🙂 ... View more

hi smoir, i have managed to get the data to splunk enterprise security after go though all the links. thank you very much for your help ... View more

Hi Smoir I have imported the cisco amp app to ES but still i cant see any data. ... View more

Hi Smoir, Thank you for replying. no its not. the app is not using "TA-" naming convention when i uploaded to the search head. its using "amp4e_events_input" as its folder name in $SPLUNKHOME\etc\apps i will follow this document and import the app as instructed. i will keep you posted. ... View more