For convenience, building on top of the previous response regarding the one-liner: The following is an example from the Monitor Windows data with PowerShell scripts - Splunk Documentation which allows for a multiline script using the [powershell] rather than [script] stanza [powershell://MSExchange_Health] script=. $SplunkHome/etc/apps/TA-Exchange-2010/powershell/health.ps1 Testing this at the moment with a custom PS script but doesn't fill me with supreme confidence when the official example references TA-Exchange-2010. ... View more

Thanks @VatsalJagani. As you've indicated, the positive lookahead is not required in this case. I was looking ahead for a particular string, before realising that the target string was present at the end of the source data (this won't always be the case). I initially appended the desired text to the existing lookahead, followed by the end of line ($), at which point I noticed the odd behaviour. The issue was resolved quite quickly as you've described by removing the lookahead. The question was more in regards to why the rex string was causing Splunk to behave as if a token wasn't being passed to the drilldown. The description of $$ vs $ in the SimpleXML source provides a good explanation of why this likely occurred and how it could be resolved if alternative regex such as [\r\n] isn't (or can't be) implemented. ... View more

Thanks - to clarify, the original message was quite likely "waiting for input" rather than "waiting for data", and you're correct regarding the typo for $row._time with no trailing $. I believe I originally edited from the GUI, but it makes sense that the regex end of line was being interpreted as part of a token string to prompt with this message. In the case of 'end of string' inputs, the lookahead won't be required, and for other inputs, I imagine [\r\n] or variants could be used. Thanks for the quick response 🙂 ... View more

Slight update to this link to reflect a more recent version of Splunk: https://docs.splunk.com/Documentation/Splunk/8.2.5/Alert/EmailNotificationTokens Quick Reference: Search Name: $name$ Search Description: $description$ Results Link (reports & alerts): $results_link$ Search String: $search$ Link to saved search: $view_link$ Fields: $result.fieldname$ Job Details $job.earliestTime$ Initial job start time $job.eventSearch$ Subset of the search that appears before any transforming commands $job.latestTime$ Latest time recorded for the search job $job.messages$ List of error and debug messages generated by the search job $job.resultCount$ Search job result count $job.runDuration$ Time, in seconds, for search job completion $job.sid$ Search ID $job.label$ Search job name Dashboard Label: $dashboard.label$ Dashboard Description: $dashboard.description$     ... View more