Hi, I am modifying my logging in my application (Java spring boot) to include: key/value pair list and a JSON string of relevant data/information I want to log to trigger Splunk's Automatic Field Extraction. Key/value pair list:   [key1=val1, key2=val2, key3=val3, etc]   and JSON string:   { "field1" : "value1", "field2" : null }     Can anyone inform me how to possible generate some dummy events like this so I can test that the Automatic Field Extraction is indeed extraction the KEY from the list and assigning the correct VALUE? Similarly for the JSON string, if it's possible. If not , I suppose I can just use the spath feature. ... View more

[Filter: smut] anonymous_hippo's post body matched "damn", board "splunk-search". Post Subject: How to simply filter out text String from search results that has line breaks/return in it on SPLUNK Enterprise? Post Body: I'm really annoyed,  I am using SPLUNK Enterprise and I'm literally tryin to parse out some JSON (basically a String) from my Splunk Logs that has linebreaks after each field/key in the JSON string result , i.e. Some random search results here { key1: value1 key2: value2 key3: value3 }, some log message here   .... Like .* and many other REGEX chars work just fine in the search for some damn reason I tried all combinations of [\r\n\s]+ and such and get 0 results despite it working just fine in regex101.com online sandbox environment  I think I read online from my searches that Splunk logs don't preserve the linebreaks, but if it doesn't do that, then what is the final result looking like then? because I tried querying with out whitespaces, or linebreaks, and every combination under the sun, and never got a "hit" back on my search results. Also, I'm not using any of that REX crap as I don't need to extract anything; I just wanted to filter and maybe do a stats count on my results    Can anyone provide a simple solution please thank you! Body text "damn" matched filter pattern "damn". Post by User[id=237938,login=anonymous_hippo] has message uid 573934. Link to post: How to simply filter out text String from search results that has line breaks/return in it on SPLUNK Enterprise? ... View more

I'm really annoyed,  I am using SPLUNK Enterprise and I'm literally tryin to parse out some JSON (basically a String) from my Splunk Logs that has linebreaks after each field/key in the JSON string result , i.e.   Some random search results here { key1: value1 key2: value2 key3: value3 }, some log message here     .... Like .* and many other REGEX chars work just fine in the search for some reason I tried all combinations of [\r\n\s]+ and such and get 0 results despite it working just fine in regex101.com online sandbox environment  I think I read online from my searches that Splunk logs don't preserve the linebreaks, but if it doesn't do that, then what is the final result looking like then? because I tried querying with out whitespaces, or linebreaks, and every combination under the sun, and never got a "hit" back on my search results. Also, I'm not using any of that REX crap as I don't need to extract anything; I just wanted to filter and maybe do a stats count on my results    Can anyone provide a simple solution please thank you! ... View more

I'm trying send an e-mail from my Splunk Search Alert (I am using SPLUNK Enterprise), but I'm getting an error message "command="sendemail", 'rootCAPath' while sending mail to: MySuperCoolEmail101@gmail.com" and when I try a solution that involves going to Settings to Add a Role, I don't see that option listed at all.   My search query is something like (reference https://community.splunk.com/t5/Reporting/How-to-get-Splunk-sendemail-command-to-send-multiple-emails/m-p/126815)     index=rtm source="/mypath/app.log" SomeRandomTextHereForTesting | sendemail to="MySuperCoolEmail101@gmail.com" format=raw subject=myresults server=mail.splunk.com sendresults=true       I found this post which suggests adding some "list_settings" role by going to Settings > Access Controls > Roles, but I do not seem to have that option (reference https://community.splunk.com/t5/Reporting/splunk-dashboard-cant-sent-email/m-p/489388)   Am I doing something wrong? Is this because I'm on Splunk Enterprise? Am I using the correct mail server? How do I add ROLES? ... View more