Hi @everyone, @skoelpin, Can you please help me in this. I have firefox program installed in my system . Now , I am getting in my splunk event when I ran the query for what are the software I have installed in my system and this is expected. Now, If I remove/uninstall firefox from my system and then search the splunk query , it still appears in the splunk event. There is a field in the event called LastUsedTime and the reason we are still seeing the events as the logs retention period is for 90 days. Now, I want a fresh result of the search where application name ( firefox) shall not come if I uninstall the firefox from the system. Can help me to add a filter in the search listing for events having LastUsedTime newer than a period of choice( 1 week, 1 month, etc) or any other workaround for this ? Thanks again for your help. Binay Agarwal ... View more

I am working in a search to filter events to get the application named installed in the system. However, if I remove the application or uninstall it still apears in the event. There is a field called LastUsedTime and the reason is we are still seeing the events as the logs retention period is for 90 days. Now, I want a fresh result of the search where application name shall not come if I uninstall the same application from the system. Can anyone help me to add a filter in the search listing for events having LastUsedTime newer than a period of choice( 1 week, 1 month, etc) or any other workaround for this ? It would be of great help. Thanks in advance. Binay Agarwal ... View more

Hi Everyone, I have a string field that contains similar values as given below: String = This is the string (generic:ggmail.com)(3245612) = This is the string (generic:abcdexadsfsdf.cc)(1232143) I want to extract only ggmail.com and abcdexadsfsdf.cc and remove strings before and after that. Basically if you can notice I want string that comes inside ":" and ")" like :ggmail.com) May need to use regex. If someone can help me out, Thanks in advance. Regards, Binay ... View more

Hello Everyone, I am working to integrate "TheHive" i.e. ticketing tool like Demisto with Splunk. I searched in SplunkBase but there is no app available for TheHive. Can anyone please guide me how I can start with integration or steps need to follow. Many thanks in advance. Regards Binay Agarwal ... View more

Hi Everyone, I am creating a dashboard with multiple stats report. And I want to remove unwanted blank spaces that appears in the table. Is there any way to remove these blank spaces so can make the dashboard look even more better. Screenshot attached. ... View more