index=_internal | head 1 | fields _raw | eval _raw="{\"data\":[{\"dimensions\":[\"HTTP_CHECK-F009EA2B6AA8E2C0\",\"SYNTHETIC_LOCATION-833A207E28766E49\"],\"dimensionMap\":{\"dt.entity.synthetic_location\":\"SYNTHETIC_LOCATION-833A207E28766E49\",\"dt.entity.http_check\":\"HTTP_CHECK-F009EA2B6AA8E2C0\"},\"timestamps\":[1617467520000],\"values\":[186]},{\"dimensions\":[\"HTTP_CHECK-F06A1F4F9C3252AD\",\"SYNTHETIC_LOCATION-1D85D445F05E239A\"],\"dimensionMap\":{\"dt.entity.synthetic_location\":\"SYNTHETIC_LOCATION-1D85D445F05E239A\",\"dt.entity.http_check\":\"HTTP_CHECK-F06A1F4F9C3252AD\"},\"timestamps\":[1617467520000],\"values\":[187]},{\"dimensions\":[\"HTTP_CHECK-F06A1F4F9C3252AD\",\"SYNTHETIC_LOCATION-833A207E28766E49\"],\"dimensionMap\":{\"dt.entity.synthetic_location\":\"SYNTHETIC_LOCATION-833A207E28766E49\",\"dt.entity.http_check\":\"HTTP_CHECK-F06A1F4F9C3252AD\"},\"timestamps\":[1617467520000],\"values\":[188]}]}" | spath   https://docs.splunk.com/Documentation/Splunk/8.1.3/Knowledge/Configurefieldaliaseswithprops.conf If indexed_extractions is working properly, then the field alias in props.conf is sufficient.   props.conf [smoketest_json_dyn_tcp] CHARSET=UTF-8 KV_MODE=json SHOULD_LINEMERGE=false category=Structured disabled=false pulldown_type=true TIME_FORMAT=%s%2N TIME_PREFIX=timestamps\":\[ LINE_BREAKER=(.){"dimensions|}(\])(}) TRANSFORMS-nulls=null1, null2 transforms.conf [null1] REGEX={\"data\".* DEST_KEY=queue FORMAT=nullQueue [null2] REGEX=^}.* DEST_KEY=queue FORMAT=nullQueue This one may also be good.     ... View more

How about SEDCMD with props.conf. ... View more

index=_internal | head 1 | fields _raw | eval _raw="{\"logs_id\": \"4890d36f-5ee3-11eb-b3a5-852911ef9cd4\", \"securityContext\": { \"alternateId\": \"****@gmail.com\", \"id\": \"ramxghl092\", \"displayName\": \"****System\"}," | rex mode=sed "s/((alternateId|displayName)\":\s*)\".*?\"/\1\"*****\"/g" ... View more

[testing] LINE_BREAKER=([\r\n]+){\"transaction-id SHOULD_LINEMERGE=false NO_BINARY_CHECK=1 TRUNCATE=0 MAX_EVENTS=1024 LINE_BREAKER is better. ... View more

  index=_internal | head 1 | fields _raw | eval _raw="IP=189.41.40.129,Produto=\"Test1\",Valor=179,00,Categoria=Banho,Campanha=1,Vendeu=1,MetododeCompra=1,Bandeira=1,Transportadora=2,Frete=18,57,\"_time\"2021/01/25 19:20:37.374\" IP=201.0.205.197,Produto=\"Test2\",Valor=123,98,Categoria=Jogos,Campanha=1,Vendeu=0,MetododeCompra=0,Bandeira=0,Transportadora=5,Frete=12,58,\"_time\"2021/01/25 19:20:38.977\" IP=187.125.147.178,Produto=\"Teste3\",Valor=139,90,Categoria=Cozinha,Campanha=1,Vendeu=1,MetododeCompra=1,Bandeira=1,Transportadora=3,Frete=14,27,\"_time\"2021/01/25 19:20:38.977\" IP=187.115.202.233,Produto=\"Test4\",Valor=139,90,Categoria=Cozinha,Campanha=1,Vendeu=1,MetododeCompra=1,Bandeira=1,Transportadora=2,Frete=14,51,\"_time\"2021/01/25 19:20:39.579\" IP=187.111.15.221,Produto=\"Test5\",Valor=164,00,Categoria=Banho,Campanha=2,Vendeu=1,MetododeCompra=1,Bandeira=1,Transportadora=1,Frete=16,81,\"_time\"2021/01/25 19:20:40.580\"" | multikv noheader=t | fields _raw | rex mode=sed "s/\"_time\"/Time=/ s/=(\d.*?)(?=,[A-Z])/=\"\1\"/g" | rex "(?<time>\d{4}/.*)" | eval _time=strptime(time,"%Y/%m/%d %T.%3N") | kv   ... View more

echo '/splunk/is/not/easy/' | sed -E 's#(.*)/.+/?#\1#' ... View more

Splunk column chart cannot be displayed with two values on x-axis. This is not possible because the chart is trying to separate the time and host values. ... View more

Incorrect query. Aggregate by stats, not by timechart If you use autoregress and eval, you should be fine. ... View more

index=_internal | head 1 | fields _raw | eval _raw="{\"squadName\":\"Super hero squad\",\"homeTown\":\"Metro City\",\"formed\":2016,\"secretBase\":\"Super tower\",\"active\":true,\"members\":[{\"name\":\"Molecule Man\",\"age\":29,\"secretIdentity\":\"Dan Jukes\",\"powers\":[\"Radiation resistance\",\"Turning tiny\",\"Radiation blast\"]},{\"name\":\"Madame Uppercut\",\"age\":39,\"secretIdentity\":\"Jane Wilson\",\"powers\":[\"Million tonne punch\",\"Damage resistance\",\"Superhuman reflexes\"]},{\"name\":\"Eternal Flame\",\"age\":1000000,\"secretIdentity\":\"Unknown\",\"powers\":[\"Immortality\",\"Heat Immunity\",\"Inferno\",\"Teleportation\",\"Interdimensional travel\"]}]}" | spath | fields - _* | rename *{}.* as *_* | rename *{} as * | table * ``` this is sample data``` ``` from here, the logic ``` | eval tmp="val" | transpose 0 header_field=tmp | streamstats window=1 count(val) as count | eventstats max(count) as count | appendpipe [ eval column="count", val=count] | fields - count | dedup column | transpose 0 header_field=column | fields - column | eval count=mvrange(0,count) | mvexpand count | rename count as _count | foreach * [ eval <<FIELD>> = mvindex(<<FIELD>>,_count)] | fields - _count It counts fields dynamically, so it could be used anywhere. ... View more

  your search | streamstats count as session | mvexpand col1 | streamstats count as session2 by session | rename col1 as _col1 | foreach col* [ eval <<FIELD>> = if(session2=1,mvindex(split(<<FIELD>>,","),0),mvindex(split(<<FIELD>>,","),1)) ] | fields - session* | rename _col1 as col1   ... View more

try mvexpand ... View more

TIME_PREFIX = DE_IDENTIFICATION_DATE\"\s*:\s*\" not TIMESTAMP_FIELDS=DE_IDENTIFICATION_DATE ... View more

Please give me the entire log. There is also a way to do spath. ... View more

your log is JSON, try spath ... View more