I have a field pluginText field which has plugin paths with multiple values, i want to extract each path  for example in a json event pluginText looks like:   {,..., "pluginText": "<plugin_output>\nNessus detected 8 installs of Microsoft OneDrive:\n\n  Path    : C:\\Users\\user1\\AppData\\Local\\Microsoft\\OneDrive\\\n  Version : 22.238\n\n  Path    : C:\\Users\\user2\\AppData\\Local\\Microsoft\\OneDrive\\\n  Version : 25.140\n\n  Path    : C:\\Users\\user3\\AppData\\Local\\Microsoft\\OneDrive\\\n  Version : 21.180\n\n  Path    : C:\\Users\\user4\\AppData\\Local\\Microsoft\\OneDrive\\\n  Version : 25.65\n\n  Path    : C:\\Users\\user5\\AppData\\Local\\Microsoft\\OneDrive\\\n  Version : 21.220.\n\n  Path    : C:\\Users\\user6\\AppData\\Local\\Microsoft\\OneDrive\\\n  Version : 25.179\n\n  Path    : C:\\Users\\user7\\AppData\\Local\\Microsoft\\OneDrive\\\n  Version : 25.65\n\n  Path    : C:\\Users\\user8\\AppData\\Local\\Microsoft\\OneDrive\\\n  Version : 21.220\n</plugin_output>", "....} on search page \\n goes to new line, so i have written the following regex, on UI it's working to have multiple values | rex max_match=15 field=pluginText "Path[\s\:]+(?<plugin_path>.*?)[\n\r]" but when i tried to extract same with props and transforms using below, the extraction didn't work,  [logsourcetype] REPORT-new_plugin_path = extracting_plugin_path [extracting_plugin_path] REGEX = Path[\s\:]+(?<plugin_path>.*?)[\n\r] REPEAT_MATCH = true MV_ADD = true looking for working props and transforms for this kind of situation, thanks! ... View more

considering we can move data from one index to another index in the same cluster by moving buckets, I am in a scenario where to create an index on index cluster 2 with a new name with an increased retention time period, how do I move the data of one index which is in say cluster 1 with replication factor 3 i.e., the indexer has a copy of every bucket in other two indexers under different names, which can not be copied to the new index with a different name in cluster 2. Here the challenge is to identify the replicated buckets to avoid being copied to a new index on another cluster, so we only copy the primary buckets to cluster 2 and allow cluster  2 to create the replication buckets based on its own rep factor.   was this achievable? either UI or CLI? how? If I only want to copy data of specific sourcetype from index 1 from cluster 1 to index 2 in cluster 2 how can I do that? NOTE: I can not create the index 2 with same name as index1, it's been created and under use for other data.   How can I acive this?   ... View more

does setting the following configuration in itsi_notable_event_retention.conf will send the events if limit is reached before the specified time period. For example if the event object count exceed 500000 before the retentiontime period will the retention object go to archive?   [itsi_notable_group_user] # Default is one year retentionTimeInSec = 31536000 retentionObjectCount = 500000 disabled = 0 object_type = notable_event_group   ... View more

Hi here is sample format   Audit Log ID KMA ID KMA Name Class Retention Term Operation Condition Severity Audit Log Entry ID Created Date Entity ID Entity Network Address Message Values Solution B7086B1B57C6714E00000000009D00B1 B7086B1B57C6714E CA4SICLKMA1 Audit Log Management Operations Short Term List Audit Logs Success Success 000109000000 2023-06-05 09:35:11 AKH25wj 30.XXX.XXX.XX No recommended action B7086B1B57C6714E00000000009D00AF B7086B1B57C6714E CA4SICLKMA1 Audit Log Management Operations Short Term List Audit Logs Success Success 000109000000 2023-06-05 09:35:06 AKH25wj 30.XXX.XXX.XX No recommended action B7086B1B57C6714E00000000009D00AA B7086B1B57C6714E CA4SICLKMA1 Audit Log Management Operations Short Term List Audit Logs Success Success 000109000000 2023-06-05 09:34:17 AKH25wj 30.XXX.XXX.XX No recommended action ... View more

  Hi this is the log {"time":"2023-06-13 20:35:02.046 +00:00", "level":"Information", "client":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.12.1.0Safari/537.36 Edg/xx.x.xx.x.x", "environment":"deduction", "user":"CORP\NBSWWUK", "clientIp":"xxx.xxx.xxx.xx", "processId":"24560", "processName":"w3wp", "machine":"mymachine", "version":"", "message":"", "log":"", "requestURL":"/request/v1/Application/getorganizations", "exception":"", "requestBody":"", "requestParam":"", "exceptionStack":""} ... View more

  I want to extract fields from events similar to following event, through props.conf using regualr expression. The challange is that the event is XML formatted but it has Json data embeded in it.     I am trying to find solution similar to the solution stated in this post:https://community.splunk.com/t5/Getting-Data-In/Sed-command-Large-XML-values-in-JSON-events-makes-replacement/m-p/370664     This is how my events look like:(example event)       <25>1 2023-04-03T13:12:32.0Z AH-1249259-001 EPOEvents - EventFwd [agentInfo@3401 tenantId="1" bpsId="1" tenantGUID="{00000000-0000-0000-0000-000000000000}" tenantNodePath="1\2"] <?xml version="1.0" encoding="utf-8"?> <EPOEvent><MachineInfo><AgentGUID>{8396cab6-ec77-11ea-2747-3448edc44e42}</AgentGUID><MachineName>KB89A2AEBECBD</MachineName> <RawMACAddress>12345</RawMACAddress> <IPAddress>12345</IPAddress> <AgentVersion>5.7.5.504</AgentVersion> <OSName>Windows 10</OSName> <TimeZoneBias>300</TimeZoneBias> <UserName>chill</UserName> </MachineInfo> <SoftwareInfo ProductName="BeyondTrust Privilege Management" ProductVersion="23.1.0.259" ProductFamily="Secure"> <Event> <EventID>202256</EventID> <Severity>0</Severity> <GMTTime>2023-04-03T13:10:36</GMTTime> <LocalTime>2023-04-03T08:10:36</LocalTime> <CustomFields target="AvectoReportingEvents">      <Data>{&quot;Header&quot; : {&quot;AgentVersion&quot; : &quot;23.1.259.0&quot;, &quot;Code&quot; : &quot;106&quot;, &quot;EndpointType&quot; : &quot;MicrosoftWindows&quot;, &quot;HostDomainName&quot;: &quot;my.com&quot;, &quot;RuleScriptStatus&quot;: &quot;&quot;, &quot;AuthMethods&quot;: [], &quot;IdPAuthenticationUserName&quot;: &quot;&quot;, &quot;ConfigurationID&quot;: &quot;be94d460-c4cb-4827-8f3b-5572727c54e6&quot;, &quot;UACTriggered&quot;: 0 }}     </Data> <EventId>106</EventId> <SentTime>2023-04-03T13:10:36Z</SentTime> <Version>23.1.0.259</Version></CustomFields></Event></SoftwareInfo></EPOEvent>   ... View more