I have raw data file (similar to a CSV) with various records as follows:   Process alarm,5/31/2023,23:19:45,20,11PC_0201,# 2 BOILER STEAM DRUM PRESSURE,Medium,L-Lower Limit,South Main,110.0,110.0,PSIG Process alarm,5/31/2023,22:45:07,34,25N_0004,CP - 5kV BREAKERALARMS,Medium,TIE-BRKR CLOSED,Common Signal In my transforms.conf file: [parseProcessAlarm] REGEX = Process alarm,([^,]+),([^,]+),([^,]+),([^,]+),([^,]+),([^,]+),([^,]+),([^,]+),([^,]+),([^,]+),([^,]+) FORMAT = Date::$1 TimeStamp::$2 TagType::$3 Tagname::$4 Description::$5 AlarmSeverity::$6 AlarmName::$7 SignalCategory::$8 Data::$9 LimitData::$10 EngineeringUnits::$11   My problem is that this expression fails sometimes because a "Process Alarm" record may only have 8 data fields after the initial "Process Alarm" wording as shown above. How can I account for this?   ... View more

I have several Cisco FTD devices (managed by Cisco FMC) that are sending syslog messages to splunk. Here is the format.... <164>Sep 19 2021 13:26:27 ftdv-b-int : %FTD-4-313005: No matching connection for ICMP error message: icmp src inside_Mgmt:10.0.20.238 dst inside_Legacy_Server:192.168.0.94 (type 3, code 3) on inside_Mgmt interface. Original IP payload: udp src 192.168.0.94/53 dst 10.0.20.238/12055. The time is in UTC.... is there a way to convert this time to local when I pull the records in so I can do alerting, etc. on these records? ... View more

I've got a number of files coming from directories similar to this.... C:\File Transfer\Relay Files\8Series_files\WB-CWP\WB_CWP8_869\evt.txt I'd like to extract the WB_CWP8_869 and create it as a searchable field. The filepath always looks like this.... the section before the field I want varies.... But the beginning (C:\File Transfer\Relay Files\8Series_files\) and the end (evt.txt) is always the same. ... View more

I've got a non-standard CSV log file that has no headers. Depending on the first field of each line determines what number and order of the fields are behind it. How can I have splunk assign field names to the data depending on the first field in a given row? An example would be: Operation Record,Timestamp,Tagname,Decription,Station Alarm Confirm,Timestamp,Tagname,Station,Severity, Process Alarm,Timestamp,Tagname,Description,Value ... View more