Hi Could you please help me with using REX/REGEX inside eval? Here is what I'm trying to do  | makeresults | eval User="user1=test@domain.com | use1=test1" | makemv delim="|" User | mvexpand User | fields - _time | eval signature="87347,123,1,0,84" | makemv signature delim="," | mvexpand signature | eval account=if(like(signature,"87347") AND like(User,"%@%" )," REGEX USER TO KEEP EVERYTHING BEFORE @ "," DONT MAKE ANY CHANGES , KEEP THE USER WITH @") Thanks      ... View more

Hello, I ingested some Azure data into splunk via event hub and would like to ask if you Could you please share some idea/alerts on Azure contents . If you have Azure/Splunk in your env , What are you alerting on based on Azure logs ? Could you share some of the Alerts contents ?    Any help is much appreciated.      ... View more