Hi All, I wrote a regular expression to extract fields from an event containing data in the JSON format. The regular expression seems to be working fine on https://regex101.com/ but I am not able to transform extracted fields in the tabular format. Below is the query with regular expression: index="index_name" "<search term>" | rex field=_raw "\"(errorId)\":(?<errorId>.*),\"(errorMessage)\":(?<errorMessage>.*),\"(exceptionStackTrace)\":(?<exceptionStackTrace>.*),\"(userId)\":(?<userId>.*),\"(requestUri)\":(?<requestUri>.*)}" Below is the extended query to transform it into a table: index="index_name" "[search term]" | rex field=_raw "\"(errorId)\":(?<errorId>.*),\"(errorMessage)\":(?<errorMessage>.*),\"(userId)\":(?<userId>.*),\"(requestUri)\":(?<requestUri>.*)}" | table _time errorId errorMessage userId requestUri Not able to see data in the columns except for _time. Below is the log data: 14321 <14>1 2021-07-07T09:39:53.222524+00:00 service-name 3d5c6a75-9e10-4fad-85bc-9ab8460a2a36 [APP/PROC/WEB/0] - - 2021-07-07 09:39:53,222 [http-nio-8080-exec-7] [ERROR] [Trace: Span: ] [searchTerm] {"errorId":"c9fb515d-5e63-4d30-ae0a-3aea707eea18","errorMessage":"custom error message","userId":"test id 100","requestUri":"uri=/employee/list"} This is a sample log data but the actual data could be quite complex. Can anyone please help? ... View more

Hi team, I am trying to connect Tableau with Splunk via Splunk ODBC. On the community forum, it is mentioned at several places that Splunk ODBC is not compatible with Splunk version 7.x onwards. But I can also see that a latest Splunk ODBC driver (version 3.0.1) has been released recently and it is mentioned that it is compatible with Splunk version 7.3 and higher as below:- https://splunkbase.splunk.com/app/1606/ My Splunk enterprise version is 7.2.9.1 and the tableau version is 2019.1.7. Is this new Splunk ODBC compatible with my version of Splunk (7.2.9.1)? If not then what is the alternative for this? Thanks. ... View more