Hi Splunkers, I have a question related to a json file that I'm trying to parse.I want to remove the first part of it until {"kind"), see sample file is added below. I tried using the FIELD_REGEX_HEADER in props.conf which I think is supposed to that so far I've tried an failed with the following: FIELD_HEADER_REGEX={"activities":\s\[(.) FIELD_HEADER_REGEX={"activities":\s\[ FIELD_HEADER_REGEX={"activities": FIELD_HEADER_REGEX=\{\"activities\"\: Some of the above work on regexr.com with the sample data. {"activities": [{"kind": "admin#reports#activity", "id": {"time": "2022-07-18T14:04:19.866Z", "uniqueQualifier": "-2451221827967636314", "applicationName": "redacted", "customerId": "redacted"}, "etag": "\"dng2uCItaXPqmMj2MG4RUqVkRjnE_4kf0VvQ0_WkiTg/6j3Reg7FneLgLDfjE-lZuZUOrdc\"", "actor": {"callerType": "USER", "email": "redacted", "profileId": "redacted"}, "ipAddress": "redacted", "events": [{"type": "SECURITY_INVESTIGATION", "name": "SECURITY_INVESTIGATION_QUERY", "parameters": [{"name": "INVESTIGATION_DATA_SOURCE", "value": "USER LOG EVENTS"}, {"name": "INVESTIGATION_QUERY", "value": "(empty)"}]}]}, Any help is appreciated thank you!
... View more
