Hi @GRC , Please see my query below (based on your data):   | makeresults count=2 | streamstats count | eval _raw=if(count=1,"Dec 14 20:31:05 abc-05-hiddencam MSWinEventLog#0111#011System#011622650#011Tue Dec 14 20:31:05 2021#0117036#011Service Control Manager#011N/A#011N/A#011Information#011abc-05-hiddencam#011None#011#011The Google Update Service (gupdate) service entered the stopped state.#01176625","Dec 13 09:03:18 abc-05-hiddencam MSWinEventLog#0111#011Security#011620683#011Mon Dec 13 09:03:16 2021#0114634#011Microsoft-Windows-Security-Auditing#011abc-05-hiddencam\Alis#011N/A#011Success Audit#011abc-05-hiddencam#011Logoff#011#011An account was logged off. Subject: Security ID: S-1-5-21-193828115-2933347444-2245271187-1049 Account Name: Alis Account Domain: abc-05-hiddencam Logon ID: 0x8ac469ffa Logon Type: 10 This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.#011304150") | rex field=_raw "(?<Date>\w{3}\s+\d+ \d+:\d+:\d+)\s(?<hostname>\w+-\d+-\w+).*(?<status>service\s\w+\s\w+\s\w+\s\w+)" | rex field=_raw "(?<Date>\w{3}\s+\d+ \d+:\d+:\d+)\s(?<hostname>\w+-\w+-\w+).+Audit\S+\s\w+\s\w+\s(?<status>.+).\s\s\s\sSub.+Account\sName\S+\s+(?<user>\w+).+" | eval "Hidden Cam Monitoring" = Date + " : " + hostname + " " + status + if(isnotnull(user)," "+user,"") | table "Hidden Cam Monitoring"   If you'll notice, I've added an if clause to the eval function. The reason is that when trying to eval a field based on a filed that doesn't exist in the data, the eval will fail and you'll end up with empty field.   ... View more

Hi @GRC,   There are 2 way you can approach this task: 1. Build your REX filter so it will take into account the type of event you're looking at - add the "logged" or "entered" as part of your regex. 2. Keep both you searches and add the append command between them. This option is easier to implement, but will take a bit longer to execute since you'll be running two searches. ... View more

Hi @GRC  The reason your query only captured double dot string is because you accidentally asked it to do so. Since \s is regex for space and after it you lest the actual space, your query looked for \s\s. For example, we used "\d+" when looking at the date because we don't know if a single digit day (the 1st-9th of each month) will appear as a single digit (1-9) or double digits (01-09), adding the "+" means that Splunk will match any length of consecutive digit strings. The same goes when your unsure of how many spaces are between each part of your data. You can use this query; (?<Date>\w{3}\s+\d+ \d+:\d+:\d+) ... View more

Hi @GRC  If you wish to account for multiple spaces, you can replace each space in the regex with \s+ \s is the regex for space, and the plus sign indicates that it might have more than one consecutive appearance.   ... View more

The first part of your regex: (?<Date>\w{3} \d+ \d+:\d+:\d+) can be matched twice within _raw The first time at the beginning of the event, and the second time a bit further down the line. You can use the following (assuming that I guessed some of your desired fields correctly) | rex field=_raw "^(?<Date>\w{3} \d+ \d+:\d+:\d+) (?<hostname>.+) \d+: \w{3}.*User:(?<user>\w+).*:(?<command>.*)$" few things to note: 1. Field names are case sensitive, so your table command must call the field exactly as you name it ("Command"!="command") 2. The regex for field extraction in REX is the following: (?<field_name>SOME_REGEX)        -you must have some regex after the field name (in your example <command> is missing regex)        -each extraction should be within a single parenthesis (your <hostname> extraction is within double parenthesis)         -the extractions should be written in the exact order they appear in the field you're working on (it looks like you mixed the order in your extraction) ... View more

Hi @PickleRick  Thank you. I asked F5 system manager to contact them and see if maybe there's a problem from F5s side. ... View more

Hi @GRC  If you wish to query multiple indexes you can you the "append" command. The syntax will be: index= networking user* enable* host* | append [search index=linux_logs host=edc-03-tacacs enable*] | append [search index=linux_logs host=gsw-03-tacacs enable*] Or, you can combine the 2 appends since they search the same index index= networking user* enable* host* | append [search index=linux_logs (host=edc-03-tacacs OR host=gsw-03-tacacs) enable*]   If you need to use the REX command you can do it either separately for each part of the search index= networking user* enable* host* | rex field=_raw "......" | append [search index=linux_logs host=edc-03-tacacs enable* | rex field=_raw "......"] | append [search index=linux_logs host=gsw-03-tacacs enable* | rex field=_raw "......"] or if you feel comfortable enough with regex, use just one REX command after appending all necessary searches: index= networking user* enable* host* | append [search index=linux_logs host=edc-03-tacacs enable*] | append [search index=linux_logs host=gsw-03-tacacs enable*] | rex field=_raw "......"  ... View more

Hi @GRC  The problem seems to be with your regex.  If all your logs follow the same pattern, the line below should capture what you want: | rex field=_raw ":\d+ (?<hostname>.+) \d+: \w+" Basically, what you put after the <field_name> defines what the regex should catch.  Any thing outside the () represents the data surrounding your desired extraction . So if the pattern you're looking for repeat several times within the field you work on, it would be good practice to provide some regex\precise phrases for the surrounding data, to make sure you capture exactly what you need.   ... View more

Try to delete the lines you've added in the XML. You can use the editor to add the token The location of the code in the XML is important, if the <set> command isn't associated with the right panel, the token won't be able to populate.  ... View more

If the drill down open a brand new search the simplest way would be to set the drilldown from the editor as 'link to search" and then once you click the value it will be added as a search parameter in the new search. If the drilldown is connected to the second panel in your dashboard, you should set the token as "click.value2" and make sure that the other panel is dependent on the value of the token. ... View more

If the value is passed down from another search you shouldn't use <init><set> by doing so you remove any value that TransactionId token might have held when the search was called.   Just to make sure that I understand the flow: A base search->clicking the result->opening a new search that should use the result from the previous search   is it correct?   ... View more

Hi @GRC  Sorry for misleading you, instead of "where" use "search" |search Type!="SELECT" ... View more

Hi GRC, table command will show all columns provided even if they don't exist in some (or all event). So even if the REX command won't capture SELECT, events that has SELECT in their query will still show in your final table, only without any value under the column of "Type".  If you wish to exclude SELECT from your table you can simply add: | where Type!="SELECT"   ... View more

Hi sarit_s, What initiates the var $TransactionId$? Is it an input from the user? a search result from one of the searches in the dashboard? ... View more

I'm receiving TCP events directly from other sources as well, and the majority of them are not missing events. The only other source that show the same behavior is Arcsight, but the issue there (according to our support vendor) is that Arcsight sends too much data over one port and syslog-ng can't handle the load, which might explain the occasional missing logs.  F5 logs are configured as TCP input directly and are not being ingested by syslog-ng. ... View more

Thanks @PickleRick  I've tried to check where the data disappears. When looking at the PCAP file from the HF I can see the event, but when searching for it I cannot find it. Any idea how I can solve it or perhaps an idea for workaround? ... View more