Hello Splunkers! I have an issue in grouping multivalued field after extracting fields from nested xml. The sample is as follows,   <WorkstationMetrics xmlns=“xxxxxxxx”> <WorkstationMetricData TypeCode="None" WorkstationID="0"> <SequenceNumberValue Timestamp="2022-05-1" TypeCode="First">15704</SequenceNumberValue> <SequenceNumberValue Timestamp="2022-05-1" TypeCode="Last">15710</SequenceNumberValue> </WorkstationMetricData> <WorkstationMetricData TypeCode="Manual" WorkstationID="03"> <SequenceNumberValue Timestamp="2022-05-1" TypeCode="First">9395</SequenceNumberValue> <SequenceNumberValue Timestamp="2022-05-1" TypeCode="Last">9463</SequenceNumberValue> </WorkstationMetricData> <WorkstationMetricData TypeCode="Manual" WorkstationID="05"> <SequenceNumberValue Timestamp="2022-05-1" TypeCode="First">62</SequenceNumberValue> <SequenceNumberValue Timestamp="2022-05-1" TypeCode="Last">297</SequenceNumberValue> </WorkstationMetricData> </WorkstationMetrics>   I tried with following search query to  extract field. But the fields extracted are multivalued with varying cardinality and hence some of my mvzip commands are not working as expected. Please find below my search query for your reference.   index=... sourcetype=... | spath output=workstationNumber path=WorkstationMetrics.WorkstationMetricData{@WorkstationID} | spath output=sequenceType path=WorkstationMetrics.WorkstationMetricData.SequenceNumberValue{@TypeCode} | spath output=sequenceNumber path=WorkstationMetrics.WorkstationMetricData.SequenceNumberValue | eval consolidate=mvzip(sequenceType,sequenceNumber) | mvexpand consolidate | eval temp=split(consolidate,","), type=mvindex(temp,0), seqno=mvindex(temp,1) | table workstationNumber type seqno   I expect to present this data in following format, could some one  Sl.no WorkstationID TypeCode SequenceNumberValue 1 0 First 15704 2 0 Last 15710 Any help in mapping 2 multivalued fields with varying cardinality would resolve this issue. Or do we need think out of box? ... View more

I am looking for a way to some how extract and mask some of important information that comes within logs. I don't have absolute permission to access "props.conf" and "transforms.conf" and hence i have to first search for the key word, extract the key field and then then mask it. The information that i wish to mask is password and login credentials which is part of field . USER_CREDENTIAL, field is of the format \"userID\":\"ABC1234\" ,\"password\":\"abcd345\", \"email\":\"abcd@gmail.com\",\"country\":\"AAAA\" i tried the following format to extract "password", rex field=USER_CREDENTIAL "(?\w+\D+\w+[^\]) but it extract both userID and password as PASSWORD, I am also looking for an easy way to mask the same, earlier i tried of masking the details but i was left with masking both userID and password, basesearch | rex field=USER_CREDENTIAL mode=sed "s/(\w+)(\D+)(\w+)(\w+)/1\\":\\"XXXXXXX/2", but the masking is not efficient when the format in userID changes. Hence thought of extracting the field and then masking the same. Please do suggest if there could be any easy way to get the masking done. ... View more

Hi all. Apologies for asking such an unclear and hazy question. I have a situation to show transactions in 2 different time references. The 1st part of the table where i am showing transaction at application level (APP name) with time bucket _time span=15m ** and I also need to show what is the peak transaction count in last 1sec for the identified APP name. I tried **appendcols and then had a separate search for peak value at bucket _time span=1s. But when i downloaded the report I couldnt get the table structure clearly. The last column is going beyond the time column as per the primary search. So how to ensure, we get a peak value transaction as the later half despite showing value of count in a 15mins window? ... View more