@ITWhisperer  I already provided a few events though, but not working on them as expected. Thank you so much again, appreciated for all of your efforts. [2023-04-25 07:43:23,923] INFO signin 2055ddf870d6un9d1 6567bfb signIn SUCCESS user:bn4bfb monitorId:2056dhf40d6b9d1 IPaddr:15.218.61.1 userAgent:"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 Edg/111.0.1661.41" userDescription:"64b9ib" sessionType:STANDARD browser:Chrome(111) os:windows [2023-04-25 07:44:01,520] INFO signin 009012cf0cce64c7 rmk9ddb signIn SUCCESS user:o0glddb monitorId:00amki2cf0cce6c7 IPaddr:15.198.2.35 userAgent:"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 Edg/101.0.1661.41" userDescription:"ugdi8db" sessionType:STANDARD browser:Chrome(111) os:windows [2023-04-25 07:45:13,632] INFO signin b9660cc3afe54c2 j56lb signIn SUCCESS user:j79lb monitorId:bop9060cc3afe54c2 IPaddr:10.209.23.194 userAgent:"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 Edg/111.0.1661.41" userDescription:"jw908b" sessionType:STANDARD browser:Chrome(111) os:windows [2023-04-25 07:46:09,358] INFO signin 0904c268c6b7e9d58 jw095lb signOut SUCCESS user:090wjlb monitorId:59c9098c6b7e9d5io [2023-04-25 07:46:47,077] INFO signin ee2bop9853a5623c 65co9b signIn SUCCESS user:6op0bb monitorId:ee2klo853a562op IPaddr:10.54.190.56 userAgent:"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 Edg/111.0.1661.41" userDescription:"6op0bb" sessionType:STANDARD browser:Chrome(111) os:windows 2023-04-25 07:46:19,358] INFO signin 0903sdgt268c6b7e9d58 jw0k95lb signOut SUCCESS user:08aaswjlb monitorId:587a9098c6b7easd89asio [2023-04-25 07:46:47,077] INFO signin ee2nmp9853a5A623c 65nAha9b signIn SUCCESS user:6mkB0bb monitorId:ee2klnmaa53a562op userAgent:"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 Edg/111.0.1661.41" userDescription:"6mkap0bb" browser:Chrome(111) os:windows   ... View more

Hello @ITWhisperer , Sometimes other fields (and data) are missing in some cases (not the only fields/data I mentioned in my last message), do you think your REGEX can handle that as well?   ... View more

Hello @ITWhisperer , Thank you again. So, you are saying. \[(?<field1>[^\]]+)\]\s+(?<field2>\S+)\s+(?<field3>\S+)\s+(?<field4>\S+)\s+(?<field5>\S+)\s+(?<field6>\S+)\s+(?<field7>\S+)\s+(?<field8>\S+)\s+(?<field9>\S+)((\s+IPaddr:(?<IPaddr>\S+))?\s+(?<field11>userAgent:\"[^\"]+\")\s+(?<field12>\S+)\s+(?<field13>\S+)\s+(?<field14>\S+)(\s+(?<field15>\S+))?)? will cover all of the following events as those 3 events are within the same file. [2023-04-25 07:46:09,358] INFO signin 0904c268c6b7e9d58 jw095lb signOut SUCCESS user:090wjlb monitorId:59c9098c6b7e9d5io [2023-04-25 07:46:47,077] INFO signin ee2bop9853a5623c 65co9b signIn SUCCESS user:6op0bb monitorId:ee2klo853a562op IPaddr:10.54.190.56 userAgent:"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 Edg/111.0.1661.41" userDescription:"6op0bb" sessionType:STANDARD browser:Chrome(111) os:windows [2023-04-25 07:46:47,077] INFO signin ee2nmp9853a5A623c 65nAha9b signIn SUCCESS user:6mkB0bb monitorId:ee2klnmaa53a562op userAgent:"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 Edg/111.0.1661.41" userDescription:"6mkap0bb" browser:Chrome(111) os:windows ... View more

Hello @ITWhisperer  Thank you again. So, you are saying. \[(?<field1>[^\]]+)\]\s+(?<field2>\S+)\s+(?<field3>\S+)\s+(?<field4>\S+)\s+(?<field5>\S+)\s+(?<field6>\S+)\s+(?<field7>\S+)\s+(?<field8>\S+)\s+(?<field9>\S+)((\s+IPaddr:(?<IPaddr>\S+))?\s+(?<field11>userAgent:\"[^\"]+\")\s+(?<field12>\S+)\s+(?<field13>\S+)\s+(?<field14>\S+)(\s+(?<field15>\S+))?)? will cover both of the following events as those 2 events are within the same file. [2023-04-25 07:46:09,358] INFO signin 0904c268c6b7e9d58 jw095lb signOut SUCCESS user:090wjlb monitorId:59c9098c6b7e9d5io [2023-04-25 07:46:47,077] INFO signin ee2bop9853a5623c 65co9b signIn SUCCESS user:6op0bb monitorId:ee2klo853a562op IPaddr:10.54.190.56 userAgent:"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 Edg/111.0.1661.41" userDescription:"6op0bb" sessionType:STANDARD browser:Chrome(111) os:windows     ... View more

@ITWhisperer  Just to add one more thing, all of the sample events I provided are within the same files. ... View more

Hello @ITWhisperer , Thank you so much again. But I am sending you some of the events again and if you see the events 4 and 6 (in bold) if different than other sample events. Any recommendation on how to incorporate your REGEX with those structures along with other events. [2023-04-25 07:43:23,923] INFO signin 2055ddf870d6un9d1 6567bfb signIn SUCCESS user:bn4bfb monitorId:2056dhf40d6b9d1 IPaddr:15.218.61.1 userAgent:"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 Edg/111.0.1661.41" userDescription:"64b9ib" sessionType:STANDARD browser:Chrome(111) os:windows [2023-04-25 07:44:01,520] INFO signin 009012cf0cce64c7 rmk9ddb signIn SUCCESS user:o0glddb monitorId:00amki2cf0cce6c7 IPaddr:15.198.2.35 userAgent:"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 Edg/101.0.1661.41" userDescription:"ugdi8db" sessionType:STANDARD browser:Chrome(111) os:windows [2023-04-25 07:45:13,632] INFO signin b9660cc3afe54c2 j56lb signIn SUCCESS user:j79lb monitorId:bop9060cc3afe54c2 IPaddr:10.209.23.194 userAgent:"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 Edg/111.0.1661.41" userDescription:"jw908b" sessionType:STANDARD browser:Chrome(111) os:windows [2023-04-25 07:46:09,358] INFO signin 0904c268c6b7e9d58 jw095lb signOut SUCCESS user:090wjlb monitorId:59c9098c6b7e9d5io [2023-04-25 07:46:47,077] INFO signin ee2bop9853a5623c 65co9b signIn SUCCESS user:6op0bb monitorId:ee2klo853a562op IPaddr:10.54.190.56 userAgent:"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 Edg/111.0.1661.41" userDescription:"6op0bb" sessionType:STANDARD browser:Chrome(111) os:windows 2023-04-25 07:46:19,358] INFO signin 0903sdgt268c6b7e9d58 jw0k95lb signOut SUCCESS user:08aaswjlb monitorId:587a9098c6b7easd89asio [2023-04-25 07:46:47,077] INFO signin ee2nmp9853a5A623c 65nAha9b signIn SUCCESS user:6mkB0bb monitorId:ee2klnmaa53a562op userAgent:"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 Edg/111.0.1661.41" userDescription:"6mkap0bb" browser:Chrome(111) os:windows     ... View more

Hello @ITWhisperer ,   Thank you so much for the clarification and totally agree. But here are 2 things: 1.  Group Field10 should be extracted Like Group ipaddr:15.198.2.35, shouldn't be Group Field10: IPaddr:15.198.2.35;  and 2.  Please see the following 2 events, these are also part of that and don't contain all the parameters as we had before:  2023-04-25 07:46:09,358] INFO  signin           0903gt268c6b7e9d58  jw0k95lb signOut SUCCESS user:09aswjlb monitorId:587a9098c6b7easd5io [2023-04-25 07:46:47,077] INFO  signin     ee2nmp9853a5A623c  65nAha9b signIn SUCCESS user:6mkB0bb monitorId:ee2klnmaa53a562op userAgent:"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.0.0 Safari/537.36 Edg/111.0.1661.41" userDescription:"6mkap0bb"  browser:Chrome(111) os:windows   -Any recommendations?   ... View more

Hello, Thank you so much for your quick response, truly appreciate it. That REGEX is working as expected for non-value pair fields, but not working for value pair fields, see the screenshot below. Like  ipaddr (in Group feld10), shouldn't be part of the extracted field value. Also, more issues with Group 10,  ipaddr. Is there anything we can do to resolve this? Thank you again.     ... View more

Hello @bowesmana  Delta created using following logic is not giving the right output.  Output from that delta I found basically what we can get if you run:  | inputlookup testaccount_holder.csv   Any recommendations would be appreciated. Thank you! ... View more

@gcusello  Thank you so much again and certainly will do. I just double checked and yes, all configurations have been done in local folder. So, we should be fine with that as you mentioned. One more thing to confirm with you:  if we pull AWS-Add-On v7.0.  tgz file and check on Upgrade App (please see screenshot below), system will do the rest as needed to upgrade App, correct?     ... View more

Hello @gcusello, Thank you so much for your quick response, truly appreciate it. I think some custom configurations have also been made in default folder. But let me double check and reach out you if needed. Thank you again. ... View more

Hello @gcusello, How I would upgrade SPLUNK AWS-Add-On from v6.1.0 to version v7.0. Currently used v6.1.0 has been configured to pull data from S3 bucket, how  can I upgrade this v6.1.0 to v7.1 without impacting my current configurations.  Won't it be overwritten everything (including current configurations) if I use following option? Any recommendations will be highly appreciated. Thank you!     ... View more

Hello, Thank you so much for your quick response and the important resources you provided, truly appreciate it. I have one group of people they have IAM role configured and created a user with an access key and already Installed AWS-Add-On on their Cloud Server/host. Is it possible for me to use the same credentials like Key ID and Secret Key to Install AWS-Add-On  on my On-Prem HF? Thank you again! ... View more

Hello @isoutamo, Thank you so much again: if this is the link I need use https://<host>:<mPort>/services/search/jobs/{search_id}  What is the {search_id} , and how I can get that? ... View more

Hello, Thank you so much for your quick response, truly appreciate it. The main objective here is to export this report result to third party server using API. My plan is to pull the report results and store it in one of our servers using API and send that result from there to third party server using another API call. Do you have any recommendations how I can proceed or can make API call to get/pull that report  to our server? ... View more

Hello @isoutamo, I know this is the best we can do for now. Thank you so much, truly appreciate your support. ... View more

@isoutamo  I tried, but not sure why it's just extracted last 4 fields. Any thoughts? ... View more

@isoutamo , Thank you so much for your quick response, truly appreciate it. Let me try it and get back to you. Thank you again. ... View more