I can't make it work. I found some explanation here: https://community.splunk.com/t5/Getting-Data-In/How-to-replace-characters-in-logs-using-SEDCMD-in-props-conf-in/m-p/392306 but they said the change should be made in HF props.conf I need to make it work on UF for Splunk Cloud ... View more

I can't make it work. I found some explanation here: https://community.splunk.com/t5/Getting-Data-In/How-to-replace-characters-in-logs-using-SEDCMD-in-props-conf-in/m-p/392306 but they said the change should be made in HF props.conf I need to make it work on UF for Splunk Cloud ... View more

Hi Do you mean splunkd.log?  SSL is only used towards cloud ... View more

Thanks, this one suits me best. ... View more

What will be the right result? ... View more

The subsearch is returning a search string in the form (input=foo OR output=bar) . Perhaps that is not the right format for your main search. Let's try another method. This is the general form for one way of combining two searches. The problem is there is no common field between the two searches to use for grouping by the stats command. I'll let you find the common field and update the query. host="main" source="main.log" INFO syslog* | rex "(?:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\.)(?<id>(\d{1,3}))" | rex "(?:disconnect )(?<input_info>\d+)" | rex "(?:to )(?<output_info>\d+)" | append [ search host="main" source="main.log" ERROR syslog* | rex "(?=[\(](?<input>\d+)[,])" | rex "(?=[, ](?<output>\d+)[\).])" ] | stats values(*) as * by id | table _time id ... View more

Hi @dabroma5 you're welcome! Ciao and next time. Giuseppe ... View more

As a first cut, add these lines to the end of your current search: | rex field=_raw "Periodic\sconnection\scheck\s\-\s(?<num_active_svcs_chkd>\d+)\sactive\sservices" | rex field=_raw "NUMBER\sOF\sACTIVE\sservices\:\s(?<num_active_svcs>\d+)" This will give you 2 new fields, num_active_svcs_chkd and num_active_svcs. Theses names are completely arbitrary -- you can change them to suit your needs. Once you're happy with how these extractions are going, work with your Splunk admin to get these added into props.conf. Hope that helps! rmmiller ... View more

Hi dabroma5, Try this. | rex "\"label\":\"(?<port>(Eth|eth)[^\"]*)" that you can test at https://regex101.com/r/nE5Zjt/2 Ciao. Giuseppe ... View more

Hi Marcin, if this answer solves your problem, please accept and/or upvote it Ciao and next time! Giuseppe ... View more