I have a log line for when the ip is added to the blacklist and another log line with ips that were removed from the blacklist. What I need to do is search for this ip that was added in the removed line, can you help me? Here is an example of my log and my research: -------------------------------------------------------------------------------------------------------------------------------------------- index="my search" | rex field=_raw "Message: Host (?<ip>.*?) w" | rex field=_raw "Message: Hosts (?<ips>.*?) w" | eval ips=mvjoin(ips,", ") | rex mode=sed field=ips "s/, /\n/g" | table ip ips   I need to loop through the list of ips in column <ips> to find the ip of column <ip> ... View more

Hello, I'm having a problem with mvexpand in Splunk. I'm having the following error: command.mvexpand: output will be truncated at 1103400 results due to excessive memory usage. Memory threshold of 500MB as configured in limits.conf / [mvexpand] / max_mem_usage_mb has been reached. Doing some searching here on answers I came across this previous answer: https://answers.splunk.com/answers/98620/mvexpand-gives-mvexpand-output-will-be-truncated-due-to-exc... Although that solution seemed to help a lot of people it did not help me. I don't seem to see a fix anywhere else. If anyone has some advice it would be most helpful. Thanks! Taking the question, is it possible to improve this range? Here is my search: index=_raw UserName=* timeformat="%d-%m-%YT%H:%M:%S" earliest="01-12-2021T00:00:00" latest="02-12-2021T23:59:00" | stats values(_time) as Time by UserName | eval i = mvrange(0,20) | mvexpand i | eval reconnection=if(UserName==UserName, tonumber(mvindex(Time,i+1))-tonumber(mvindex(Time,i)), "falha") | where reconnection>0 AND reconnection<1200 | eval reconnection=tostring(reconnection, "duration") | chart count by reconnection ... View more

Hi, splunkres! I have a search that returns several text fields and I would like to form a table with predefined rows and columns, how can I do this? Here is an example from my research: index=search timeformat="%d-%m-%YT%H:%M:%S" earliest="26-10-2021T00:00:00" latest="26-10-2021T23:59:00" | rex field=search "VPN-ANTIVIRUS-WIN:Mandatory:(?<campo1>.*?):" | rex field=search ";VPN-ANTIVIRUS-RUN-WIN:Audit:(?<campo2>.*?):"   Format of the table I want to return: Título Campo Status linha1 titulo do campo campo1 linha2 titulo do campo campo2   And this way I can put as many lines as I want   ... View more