Hi as @ITWhisperer said, to help you we are needing your sample data and explanation what you try to get from that sample (if it's not obviously based on your sample). Otherwise you could try it with https://regex101.com which also have option to save & share your regex. r. Ismo ... View more

If you are looking something up, then yes you would expect there to be at least two column, but if you are just doing inputlookup you can have just one column ... View more

thanks, but i have to write a app for detecting XSS attack with splunk. can you help for it? ... View more

HI couple of questions as I didn't get those from your question. Are configured that UF as Deployment client for splunk server or just add it with local configurations? Have you configure splunk server's monitoring console part and add forwarders monitoring there? Have you gotten any internal logs from UF to server? Can you share your UF's outputs.conf, inputs.conf, deploymentclient.conf and serverclass.conf from you server and UF? r. Ismo  ... View more

thanks a lot @scelikok, I'm not familiar with Bare Metal but I read about it. my OS is windows and I have to install Linux OS on VM ware then install Bare metal, according to it what's your idea about it? what is the advantage of bare metal over the docker or another clouding system? ... View more