Hi @vikas1  It's just a view setting and can be disabled under Format > Row Numbers, as shown below Hope that helps     ... View more

Hi @SplunkDash  I can see a few things... 1. This is a search time extraction so need to be specified it on the search head (maybe you have)      - this can be done via the SH UI too 2.  You've specified the REGEX like an inline field extraction (see props.conf.EXTRACT) so you would not have to use transforms configuration for this (though I believe it does work in transforms). 3. The regex is not quite right Try this instead (inline or transforms)    {"UserID":"(?P<UserID>\w+)","UserType":"(?P<UserType>\w+)","System":"(?P<System>\w+)","UAT":"(?P<UAT>.+?)","EventType":"(?P<EventType>.+?)","EventID":"(?P<EventID>.+?)","Subject":"(?P<Subject>.+?)\","EventStatus":"(?P<EventStatus>.+?)","TimeStamp":"(?P<TimeStamp>.+?)","Device":"(?P<Device>.+?)","Msg":"(?P<Message>.+?)"}   Having said that, the example events are a good example of using the power of transforms to match reoccurring patterns and extract them as key value pairs.   In that case the transforms.conf settings would be something like this.   [fieldEtraction] REGEX = "([^"]+?)":"([^"]+?)" FORMAT = $1::$2   The REGEX specifies two capture groups and the FORMAT extracts each group as field = value, repeatedly (up to 10000 times, by default). Some doc links as reference https://docs.splunk.com/Documentation/Splunk/8.2.7/Admin/Transformsconf#transforms.conf.example https://docs.splunk.com/Documentation/Splunk/8.2.7/Admin/Propsconf#Field_extraction_configuration Hope that helps ... View more

Hi @bluewizard  Assuming that the updated field is a date field, you could set up another scheduled job to purge data older where the updated field is older than 90 days.   For example | inputlookup suspicious_domain.csv | eval updated_epoch=strptime(updated, "<add the date format here>") ``` new field with time as epoch seconds ``` | where updated_epoch >= relative_time(now(), "-90d") | fields - updated_epoch ```|outputlook suspicious_domain.csv ``` ``` <<< uncomment when ready to overwrite the lookup file ```   Hope that helps ... View more

Hi @Tao_Zeng  When using search you also need to escape the backslash  https://docs.splunk.com/Documentation/Splunk/9.1.0/Search/SPLandregularexpressions#Backslash_characters So, this should work... | makeresults | eval TEST="\n User-Agent: iOS/16.4.1 iPhone\n P-Access-Network-Info: 3GPP-NR-TDD;utran-cell-id-3gpp=4600101200e020432103\n Security-Verify: ipsec-3gpp;alg=hmac-md5-96;ealg=null;mod=trans;port-c=9950;port-s=9900;prot=esp;spi-c=2155781586;spi-s=4286488018\n" |rex max_match=0 field=TEST "P-Access-Network-Info:\s*(?<KeyValue>.+)\\\n" ... View more