Hi everyone, I am new to Splunk and  I have been trying to do a complex report that I haven't been able to solve so please any help would appreciate a lot. I need to create a table like this: ID Name Function   Device Number  Unit  1 AAA23 Allocate A1 12 U1       A2 15 U2       A3 13 U1       A4 12 U4 2 AAA23 Allocate A1 12 U1 3 AAA23 Deallocate A1 12 U1       A2 15 U2 Here are the three events in JSON format: 1{"ID":"1","NAME":"AAA23","FUNCTION":"1", "DEVICE_001":”A1”,”NUMBER_001”:12,”UNIT_001”:”U1”, "DEVICE_002":”A2”,”NUMBER_002”:15,”UNIT_002”:”U2”, "DEVICE_003":”A3”,”NUMBER_003”:13,”UNIT_003”:”U1”, "DEVICE_004":”A4”,”NUMBER_004”:12,”UNIT_004”:”U4”} 2 {"ID":"2","NAME":"AAA23","FUNCTION":"1", "DEVICE_001":”A1”,”NUMBER_001”:12,”UNIT_001”:”U1” } 3{"ID":"3","NAME":"AAA23","FUNCTION":"2", "DEVICE_001":”A1”,”NUMBER_001”:12,”UNIT_001”:”U1”, "DEVICE_002":”A2”,”NUMBER_002”:15,”UNIT_002”:”U2”) As you can see the name of the fields DEVICE, NUMBER and UNIT depends on the number of entries in the NAME & ID fields so, sometimes for the same NAME & ID   field values I have 50 different name fields with a consecutive number, so as an example the previous fields are: DEVICE_001 ,DEVICE_002,…,DEVICE_050 NUMBER_001, NUBMER _002…., NUMBER _050, UNIT_001, UNIT_002,…, UNIT_050 And sometimes only 1 entry . this is variable and don´t depend on a specific field name.   With this in mind my question is how I can set this search on a Table Splunk: I have been trying the next: index=dataexample  |spath |rex "DEVICE_\d+":"(?P<DEVICE_1>[a-zA-Z0-9]+)" max_match=0 |rex "NUMBER_\d+":(?P<NUMBER_1>\d+)" max_match=0 |rex "UNIT_\d+":"(?P<UNIT_1>[a-zA-Z0-9]+)" max_match=0 |eval TIPO=case(FUNCTION ==01,"ALLOCATE", FUNCTION ==02,"DEALLOCATE", FUNCTION ==03, "OTHER") | stats values(NAME),values(TIPO),values(DEVICE_1), values(NUMBER_1), values(UNIT_1) by ID But I don´t know how to set all the variable( 1 or 50 or 60 ) field values in just one column per each DEVICE, NUMBER, UNIT per each event. ... View more

Hi Everyone, I am new at masking data and I want to mask a field wich corresponds to a TDC from a CSV file. Here are sample of data that is already indexed in Splunk: 10,I,T10,4152312098821234,05/05/2018,12:43:12 a. m.," $1,000.00 " 19,R,T19,4152312098348591,05/05/2018,09:43:12 a. m.," $1,900.00 " If you look the third field is the credit card number. I have set the next things in Transforms.conf [tdc-anonymizer] REGEX = ^(?:[^,\n]*,){3} FORMAT = \d{4}########\d{4} DEST_KEY = _raw I have set the next in propf.conf [csv] REPORT-anonymize = tdc-anonymizer But it does not work, can anyone please help me ?? I have also try this pair of options in transforms.conf but do not work too [tdc-anonymizer] REGEX = ^(?:[^,\n]*,){3}$ FORMAT = $1\d{4}########\d{4}$2 DEST_KEY = _raw [tdc-anonymizer] REGEX = ^(?:[^,\n]*,){3}$(?P\d{16}) FORMAT = $1\d{4}########\d{4}$2 DEST_KEY = _raw Thanks in advance ... View more

Hello everyone, I have a problem with my timestamp fields. Splunk doesn't recognize the timestamp because it comes from two different fields. Here is my data from my own application: date_reported | id tra| date_issue| time_issue | error message 20160211|101|20160210|13|111 20160211|195|20160210|124|111 20160211|273|20160210|1135|111 20160211|280|20160210|11136|111 20160211|307|20160210|140040|111 20160211|343|20160210|45|111 The first field is the date in which an issue was reported, the second field is the id of the transaction that failed, the third field is the date in which the issue happened, the fourth field is the time when the issue happened, and the fifth field is the message number of the error. All the fields are separated by | pipes. I want that the timestamp be recognized from field 3 (year, month, day) and field 4 (time HHMMSS), but the problem is that field 4, erase 0 from left. For example, the records are: 20160211|101|20160210|13|111 the time is 00:00:13 but there is no 0000 at left 20160211|195|20160210|124|111 the time is 00:01:24 but there is no 000 at left 20160211|273|20160210|1135|111 the time is 00:11:35 but there is no 00 at left 20160211|280|20160210|11136|111 the time is 01:11:36 but there is no 0 at left 20160211|307|20160210|140040|111 the time is 140040 it is ok 20160211|343|20160210|45|111 the time is 00:00:45 but there is no 0000 at left and so on. So how can I extract the correct timestamp? Thanks in advance ... View more

Hello Everyone, I want in my reports display the name of the owner instead of the IP address. My report right now shows the IP, so I created a lookup CSV file in which the IP is associated with the name. What I want is to replace the IP with the name in the lookup and have that appear in the report. The problem here is that the search is using the tstats command and the IP comes from an accelerated data model that does not include the field name that appears in my CSV file. How can I retrieve the name that is in my CSV file instead of the IP field that is on the data model? ... View more