Hello there, I would like to convert the  default time to the local country timezone and place the converted timezone next to the default one The defaut timezone is Central European time and based on the country name available in the report, need to conver the timezone. I guess i need to have a lookup table which the coutryname and the timezone of that country Timestamp CountryCode CountryName Region 2023-10-29T13:15:51.711Z BR Brazil Americas 2023-10-30T10:13:19.160Z BH Bahrain APEC 2023-10-30T19:15:24.263Z AE Arab Emirates APEC   ... View more

I am extracting these three values and if there is any empty value in any of the fields, it returns as no result. How i replace the blank values with NA in the rex statements   | rex field=AddtionalData "Business unit:(?<BusinessUnit>[^,]+)" | rex field=AddtionalData "Location code:(?<Locationcode>[^,]+)" | rex field=AddtionalData "Job code :(?<Jobcode>[^,]+)" | stats count by  BusinessUnit Locationcode Jobcode | fields - count ... View more

Hello I have created an email alert and the recipients are pulled from the search results.  Below is the part of the search query | stats count by CreateTimestamp  CCRecipients | rename CCRecipients as Recipients | table CreateTimestamp Recipients | fields - count and in the email alert configuration i added this $result.Recipients$ under the CC field Now without having Recipients in the search results, i cannot parse it in the CC field. So now when the mail gets triggered, the values in Recipients are getting displayed as part of the table, now do i mask this from appearing in the email? ... View more

Hi, I am using the following script in Splunk query. Here i am trying having multiple values in field AdditionalData and splitting them to extract the fields and writing to separate fields. Now if there is any blank value, in any of these extract fields, i want to have the default value appear as Not Available.  Thanks in advance | eval "AddtionalData"=if(isnotnull('cip:AuditMessage.ExtraData'),'cip:AuditMessage.ExtraData',"Not Available") | rex field=AddtionalData "Legal employer name:(?<LegalEmployerName>[^,]+)" | rex field=AddtionalData "Legal entity:(?<LegalEntity>[^,]+)" | rex field=AddtionalData "Country:(?<Country>[^,]+)" | rex field=AddtionalData "Business unit:(?<BusinessUnit>[^,]+)" ... View more

Hi @gcusello  Need one more help, from the below log, i am able to remove all the wild characters using below script, but need to retain the commas in the texts (in italics) between  Message and Details, similarly for Message and Success Appreciate the help | eval "EM"=if(isnotnull('cip:AuditMessage.MessageText'),'cip:AuditMessage.MessageText',"Data Not Found") | rex field=EM max_match=0 "(?<ErrMes>\w+)" | eval ErrorMessage = mvjoin (ErrMes, " ") | rex field=ErrorMessage Message\s+(?<ErrorResponse>.*)\s+Details\s+Message\s+(?<ErrorResponse2>.*)\s+Success {"@odata.context":"https://apistaging.payspace.com/odata/v1.0/11997/$metadata#Employee/$entity","Message":"The Nationality field is required., The Province field is required., The Code field is required., The Country field is required.","Details":[{"Message":"The Nationality field is required."},{"Message":"The Province field is required."},{"Message":"The Code field is required."},{"Message":"The Country field is required."}],"Success":false}     ... View more

I have the below string in my error log  {"@odata.context":"https://apistaging.payspace.com/odata/v1.1/11846/$metadata#EmployeePosition/$entity","Message":"Invalid value for field Directly reports to Employee Number.","Details":[{"Message":"Invalid value for field Directly reports to Employee Number."}],"Success":false} I have the code as shown below | makeresults | eval test = "{"@odata.context":"https://apistaging.payspace.com/odata/v1.1/11846/$metadata#EmployeePosition/$entity","Message":"Invalid value for field Directly reports to Employee Number.","Details":[{"Message":"Invalid value for field Directly reports to Employee Number."}],"Success":false}" | rex field=test max_match=0 "(?<test>\w+)" | eval test = mvjoin (test, "-") Now the code works by removing all the wild characters, but throws an error as I have double quotes. So need to know how i can ignore the quotes or replace it and then only need to get the string message which i have made in bold.    ... View more