Hello Ninjas, Am having some trouble trying to figure out how to use regex to perform a simple action. So I have a field called Caller_Process_Name which has the value of C:\Windows\System32\explorer.exe I want to take the "explorer.exe" part out of this field and place it in a new field (called process_name_short). So I see regex as the solution here. I have been trying the following but I do not believe I am using regex correctly in Splunk and the documentation isn't very helpful. | rex field=Caller_Process_Name (?<process_name_short>/(\w+)\.(\w+)$/) I'm sure my regex is solid as it pulls out only the explorer.exe part of the string in the online regex testers. Would anyone be willing to show me what I'm not doing right here please. Thanks 🙂 ... View more

Hello All, I am trying to make it so that when a search string returns the "No Results Found" message, it actually displays a zero. Here's what I am trying to achieve. I have a single value panel. I have this panel display the sum of login failed events from a search string. However, when there are no events to return, it simply puts "No results found" or "N/A". I want this to display a 0 as it is much easier on the eye (you know there were no results as opposed to thinking "did my search fail?"). Here's the search I have so far that will either return the sum of all failed login events, or the "No results found" message: index=infrastructure sourcetype=linux_secure "Too many authentiction failures" | rex "failures for (?<account>[\w\.]+)" | search account=* host=* | stats count as failures by account | stats sum(failures) as sub_failures | eval total_failures = if(isnull(sub_failures),"0",sub_failures | fields total_failuress It will return the total number of login failed events if any are generated. However if there are none, it will display "No results found" hwere I really want it to just display 0. Anyone willing to help a buried Splunker 😛 ... View more

Hello Everyone, Am hitting a snag and need some help. So I have an index whereby we have many account names returned to us from an index. Some of these account names end in the $ character. I am trying to filter any events where the account name ends in $ out of the result set. I have tried search NOT account_name = "*$" but this doesn't seem to work. I am guessing that $ is a reserved character or something as this works fine when filtering out other stuff not ending in a special character. Anyone got any hints for me? I would really appreciate it. ... View more