I have the following query to search results which contain a specific rest endpoint which has a UUID path parameter:     .... | regex requestURI="/baseurl/\b[0-9a-f]{8}\b-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-\b[0-9a-f]{12}\b     But it seems to be wrong. Error is :     Unknown search command '0'.     What is the mistake I am making here? ... View more

In splunk logs, I have to monitor some specific events. The identifier I use to target for those events is a text 'EVENT_PROCESSED'. So my search query is:     index=testIndex namespace=testNameSpace host=\*testHost* log=\*EVENT_PROCESSED*     It fetches me ll of my target events. Please note that EVENT_PROCESSED is not an extracted field and is just a text in the event logs. Now my aim is to find throughput for these events. So I do this:     index=testIndex namespace=testNameSpace host=\*testHost* log=\*EVENT_PROCESSED* | timechart span=1s count as throughtput       Is this correct way of determining throughput rate? If I change span to some other value, say 1h, then I change to:     index=testIndex namespace=testNameSpace host=\*testHost* log=\*EVENT_PROCESSED* | timechart span=1h count/3600 as throughtput     Is this correct way?  ... View more

I have a query which is able to fetch me the results. I want to extract the fields from raw data. So I click  on 'Extract New Fields'. But step 'Select Sample Event' just goes on and on, as shown in image below. Sample data never shows up, hence I am not able to select the target field.   I even tried other route...Event Actions -> Extract field. But nothing happens and I just see text 'Loading' on the page, as below:   ... View more