The following expression works in regex101: https://regex101.com/r/4D68Ip/1 But not in Splunk. Any help would be appreciated   (?i)nTimeframe\s+\(\w+\)\s+\w+\s+\w+\s+\%\s+\w+\\\w+\\\w+\\\w+\\\w\d+\:\d+\-\d+\:\d+\\\w+\\\w+\\\w+\\\w(?P<Successful>\d+)   We are attempting to extract 58570 from the below string. TEST STING   run.\r\nTimeframe (PT) Success Failed % Failed\r\n\r\n05:15-06:14\r\n\r\n58570\r\n\r\n681\r\n\r\n1.15\r\n\r\nIf you believe you've received this email in error, please see your Splunk"}     ... View more

Does anybody know if it is possible to add a Dashboard Studio Dashboard to the navingation in an App? When Adding a Dashboard Studio Dashboard to the navigation menu the dashboard does not display. ... View more

We are attempting to write a report querying multiple indexes, which creates a table using data from each. Our challenge is... When we add indextime or _time the report shows all the indextime for each system in the date range selected. Instead, we want to show only the latest indextime/_time in the report only for each system. (index=* sourcetype=ActiveDirectory objectCategory="CN=Computer,CN=Schema,CN=Configuration,DC=foo,DC=com") OR (index=windows DisplayName="BitLocker Drive Encryption Service" source="kiwi syslog server") | eval indextime=strftime(_indextime,"%Y-%m-%d %H:%M:%S") | eval cn=coalesce(cn,host) | stats values(*) AS * BY cn | search cn=* host=* NOT [inputlookup All_Virtual_Machines.csv | rename Name as cn] | where StartMode!="" AND operatingSystem!="" AND Started!="true" | rename cn as System, operatingSystem as OS | dedup System | table System StartMode State Started OS indextime | sort System ... View more

Hello, We need to monitor a group of users within a specific security group and alert if they have not logged in within X amount of days. Our criteria Users are contained within specific security groups. Need to return Group Name, Display Name, Last login, account status Only users who have not logged in within X amount of days from within the specific group We are able to return items 1 and 2 but are having challenges getting return last login greater than X amount of days. Any help is greatly appreciated! (index=wineventlog source="wineventlog:security" action=success (EventCode=4624 OR EventCode=4634 OR EventCode=4779 OR EventCode=4800 OR EventCode=4801 OR EventCode=4802 OR EventCode=4803 OR EventCode=4804 ) (Logon_Type=2 OR Logon_Type=7 OR Logon_Type=10)) OR (index=msad sourcetype=ActiveDirectory userPrincipalName=*) | fields memberOf,lastLogonTimestamp,userPrincipalName,description,userAccountControl,user,displayName,department | eval acctname = trim(replace(userPrincipalName, "@host.com", "")) | eval user=coalesce(user,acctname) | stats values(*) AS * BY user | search acctname=* user=* | eval uac = case(userAccountControl==66050,"Disabled, password never expires",userAccountControl==512,"Enable Account",userAccountControl==514,"Disable Account",userAccountControl==544,"Account Enabled - Require user to change password at first logon",userAccountControl==4096,"Workstation/Server",userAccountControl==66048,"Enabled, password never expires",userAccountControl==66050,"Disabled, password never expires",userAccountControl==262656,"Smart Card Logon Required",userAccountControl==532480,"Domain Controller",userAccountControl==1,"Script",userAccountControl==2,"Account Disabled",userAccountControl==16,"Locked Out",userAccountControl==512,"Normal Account",userAccountControl==8388608,"Password Expired",userAccountControl==8,"Home Directory Required",userAccountControl==32,"Password Not Require",userAccountControl==64,"Password Can't Change",userAccountControl==128,"Encrypted Text Password Allowed",userAccountControl==256,"Temp Duplicate Account",userAccountControl==2048,"Interdomain Trusted Account",userAccountControl==4096,"Workstation Tusted Account",userAccountControl==8192,"Server Trusted Account",userAccountControl==65536,"Don't Expire Password",userAccountControl==131072,"MNS Logon Account",userAccountControl==262144,"Smartcard Required",userAccountControl==524288,"Trusted for delegation",userAccountControl==1048576,"Not Delegated",userAccountControl==2097152,"Use Des Key Only",userAccountControl==4194304,"Don't Req Preauth",userAccountControl==16777216,"Trusted to auth for delegation") | rex field=memberOf "(?<Classification>(\(CG\)(.*?,)))" | eval Classification = trim(replace(Classification,",","")) | eval blanks=if(Classification!="",Classification,"No Classification") | stats values(blanks) as Classification values(displayName) as "Display Name" values(lastLogonTimestamp) as "Last Login" values(uac) as "Account Status" by acctname ... View more