I'd also carefully check the conf settings for the fourth source type and see if any values have not been updated correctly. I'd also do a quick search to see if maybe the results WAS indexed, but was marked with the wrong sourcetype... (a search that returns one specific record from the test file) | stats count as totalcount dc(sourcetype) as distinctcount by _raw ... View more

The regular method of field extraction (using IFX utility OR from Settings-> Fields -> Field extractions) doesn't allow you to extract the fields from another fields, unless you can write a regex off the _raw fields that will extract the value that you need. You would need to use Field Transforms to use another fields (which should be available before the fields transform is run, it can't include auto extracted fields. See this for more information on order of search time field extractions). So, first you need to create a Field transform (Settings-> Fields -> Fields transforms, select SOURCE_KEY as your original field name) and then create a Field extraction which refers to that transform (Settings-> Fields -> Field extractions , type should be 'Uses transform' and provide name of transform). ... View more

Now you can accept this answer. For your other question, just start a new question, since additional questions within a question are highly discouraged. It will get answered. ... View more

@somesoni2 excellent, worked like a charm. Thank you so much ... View more

Every role has certain capabilities. I can't say for certain that you're not power user. You've 4 other custom roles assigned to you and they may or may not have capabilities of power user. So easier option for you will be to check if you can change the sharing permission of any Splunk report/saved search or not. A regular user can't do that. user: this role can create and edit its own saved searches, run searches, edit its own preferences, create and edit event types, and other similar tasks. ... View more

Here you go. ... View more

As this thread is mentioned in the current (i.e. v7.1.3) docs comment section I add some more reference. From the PCRE-Change-Log (http://www.rexegg.com/pcre-doc/ChangeLog) you find down the page Version 7.0 19-Dec-06 and in this part we have: 34. Added a number of extra features that are going to be in Perl 5.10. On the whole, these are just syntactic alternatives for features that PCRE had previously implemented using the Python syntax or my own invention. The other formats are all retained for compatibility. (a) Named groups can now be defined as (?<name>...) or (?'name'...) as well as (?P<name>...). The new forms, as well as being in Perl 5.10, are also .NET compatible. This seems to be the explanation closest to the origin of this construct. And from the already mentioned Python-Docs we get: (?...) This is an extension notation (a '?' following a '(' is not meaningful otherwise). The first character after the '?' determines what the meaning and further syntax of the construct is. Extensions usually do not create a new group; (?P<name>...) is the only exception to this rule. Following are the currently supported extensions. Where this "first character after the '?'" is explained in great detail in the text that follows. ... View more

@pradjswl - 60 Karma points are required to attach files. Here's a general outline of how to earn Karma points on Answers as well as how much Karma is required in order to unlock certain site capabilities. ... View more

Take a look at this link where it explains how to anonymize data either at index time (SEDCMD) or search-time. It's pretty much your use case but instead of replacing the content with # you just want to hide it: http://docs.splunk.com/Documentation/Splunk/6.4.2/Data/Anonymizedata Let me know if that's not clear enough. By the way, if you are happy with the answer please don't forget to mark it as such so that we can close the thread. Regards, J ... View more

@sundareshr - Done. Sorry I didnt knew about Answer accepting. Just being new to site 🙂 ... View more

Thank you so much @renjith.nair ... View more

I accidentally deleted my previous comment. Great thank you @MuS for the correction in 3rd query. I feel that Event tab is displaying all events from (index=sl_logs sourcetype=sl_myworld) returning thousands of event & its not comparing /where tealeaf_eventbus=sl_myworld/ which was technically suppose to work as /a_xf_BestSessionID=x_BESTSessionID/ returning around 50-100s of event. In other word I am looking for join between two sourcetype and display only those event which having matching field value.(sourcetype=sl_myworld-> Field=a_xf_BestSessionID & sourcetype=tealeaf_eventbus->Field=x_BESTSessionID) If thats not too much to ask, Is there away I can setup a meeting to walk you through my splunk screen ? ... View more