This thread is more than 3 years old.  To help ensure more people see it and offer solutions, you should post a new question. ... View more

This really should be two postings. ... View more

Go to $SPLUNK_HOME/etc/passwd and look at what users are defined. Now you know the username. Try to login with that user and PW= changeme ; it probably won't work. Grab the PW from that file and then use the method here to decrypt it and reveal the PW: https://www.hurricanelabs.com/splunk-tutorials/make-splunk-do-it-how-to-decrypt-passwords-encrypted-by-splunk There are other methods but this is the easiest one that does not require you to have an admin-level uers's login (this only requires CLI access; it does not require any splunk user). ... View more

I'll start there, thanks Rich! ... View more

@shankarananth you are missing in target argument in your replace command, otherwise it will apply to all the available fields. | makeresults | eval target="backed(up", someotherfield="backed(up" | replace "backed(up" with "backed-up" | table target someotherfield So correct query is | makeresults | eval target="backed(up", someotherfield="backed(up" | replace "backed(up" with "backed-up" in target | table target someotherfield Here is another option with replace() evaluation function | makeresults | eval target="backed(up", someotherfield="backed(up" | eval target=replace(target,"(backed)\((up)","\1\2") | table target However, better approach would be to use SEDCMD during index-time as suggested by @mayurr98 and @somesoni2, so that data is indexed as expected, rather than using search time field corrections. As per your question you are looking for index time correction. You should also check out the feasibility of correcting the logging by application in the first place if the logged text is not as expected. Even if you don't own the code or the app is third party, you can always notify them of such correction with miss-spelled/incorrect logging! ... View more

"Mozilla\/(?P<FIELD_NAME>[^"]+) As above with the REGEX being greedy, the attached regex will also generate the name for your new field.... just replace "FIELD_NAME" with the desired name of your new field As a side note https://regex101.com/ is a fantastic place to experiment with/hone your REGEX skills ... View more

Please let me know if the answer was useful for you. If it was, accept it and upvote. If not, give us more input so we can help you with that ... View more

Your regex looks really off - copy&paste error? If not, all it does is look for the capital F followed by some characters. This should be better: \s\d+\.\d+\.\d+\.\d+\s+FAILED Note, this doesn't actually match only IPv4 addresses, but it should be correct enough. Additionally, it doesn't check if it's the first IP that's being followed by FAILED - address that if you expect events that contain FAILED after a later IP that you want to keep, for example by only looking N words deep into the event from the beginning, as these look like syslog-ish headers. There is an app for Bluecoat ProxySG on Splunkbase, that might help you a lot with field extraction and stuff. ... View more