Instead of using the max_match=100 can you try using " (?im) "... So you could test your rex command using... | rex max_match=100 "(?im)<PluginName>(?P<Vunerability_Name>[^<]+)" | and you props should be... EXTRACT-Vunerability_Name = (?im)<PluginName>(?P<Vunerability_Name>[^<]+) I believe this will work. If it answers your question can you mark the answer as accepted to help the community. Regards, MHibbin ... View more

For filtering the events I assume you are using the method listed in this doc. And matching you events in this way. I am a bit confused what you mean in your second point... more info please. ... View more

so if you are on a nix machine you could tar czvf splunkback.tgz $SPLUNK_HOME/etc. ... View more

Instead of using such an extensive regex, have you not tried breaking the extractions down. If there are any inconsistencies with your data/events, your regex will "break". ... View more

Ok if this does work, can you mark the answer as accepted, as this will help tell the community that your question does not need answering, and it also helps those looking for answers. ... View more

From my understanding Splunk should not be affecting the system commands, which are also being shared with sitescope. Are you using separate users for running theses installations? It might be conflict with the user permissioning rather than the installation itself. ... View more

Could you please provide some more information. My assumption is that you want to "hash" out the users rather than removing events involving certain users? What transforms are you using? ... View more

you could probably cut this down slightly, I just thought it best to be quite exact (for the sake of a few extra characters). ... View more

So if I understand you, you wish to create a field just for the first IP address (host IP)... I used the following search time extraction which you could modify... source="/var/tmp/logs/syslog.log" | rex field=_raw "(\w+\s+){2}(\d+:){2}\d+\s+(?P<hostIP>(\d{1,3}.){3}\d{1,3})" This will extract just the first field (using the timestamp as the defining point). If you still want to extract all the IP addresses you could do that as one field, and then pipe to my rex command for just the hostIP field. Hope this answers your question. If it does answer your question please mark the answer as accepted to help the community. Regards, Matt ... View more

This is probably a tidier version of the search command... source=*df.sh | multikv fields Filesystem Size Used Avail Use% | rex field=Used "(?i)(?P<Used>\d+)[A-Z]+" | table _time Filesystem Used This will strip out the numbers from the Used field, and replace the values in the Used field. One thought though this you SHOULD make sure the script outputs all values in script (df) in the same format by using something like... df -h --block-size=G OR df -h --block-size=GB (See Manpage for info on difference in block size) Otherwise you will be potentially mixing values that where in G or M, and treating them as the same block-size. This may not affect your analysis of the xfs file-system, however it will make the command/results more future-proof. Hope this helps, but I would definitely recommend using the rex command in this answer. Regards, Matt P.S. Thanks to Draineh for the suggestion! ... View more

please answer below where I use rex command for a "tidier" version... ... View more

I'm sure you have worked this out, but in the previous comment where I have used "eval rtrim", where there is a "d+" there should be a backslash in front of the "d+" (see other my other answer as an example). ... View more

Converted from comment, as this would not show "\" Yeah sure assuming we are still working with the table command just add the field "_time" to you search command, e.g. ... *| multikv fields Filesystem Size Used Avail Use% | eval Used=if(match(Used,"\d+G"),rtrim(Used, "G"),Used) |eval Used=if(match(Used,"\d+K"),rtrim(Used, "K"),Used)| eval Used=if(match(Used,"\d+M"),rtrim(Used, "M"),Used)| table _time Used Filesystem ... View more

The only reason I mention this is because you may have values over than in G (if the script is using df-h). Hope this helps! ... View more

If it is not you could change the strict to output in GB (or what ever value you choose, check man page for DF), you could change the script to output the results of df --block-size=GB . If modifying the script is not possible you could try the following command *| multikv fields Filesystem Size Used Avail Use% | eval Used=if(match(Used,"\d+G"),rtrim(Used, "G"),Used) |eval Used=if(match(Used,"\d+K"),rtrim(Used, "K"),Used)| eval Used=if(match(Used,"\d+M"),rtrim(Used, "M"),Used)| table Used ...See next comment! ... View more

If all the "Used" values are in Gigabytes (G), you can use *| multikv fields Filesystem Size Used Avail Use% | eval Used=rtrim(Used, "[K,G,M]") | stats sum(Used) ..... See next comment! ... View more

Not sure if you have already tried this, but a simpler solution should be to search... source="*-2011-Dec-12.csv" or if the date changes... source="*-audit-report-*" Hope this answers your question. If it does answer your question, please mark the answer as accepted (the tick next to the answer) for the benefit of the community. Regards, Matt ... View more

good job! good luck. ... View more

just combine them.... | multikv fields Filesystem Size Used Avail Use% Mounted | search xfs | table Type Used This should work, let me know? If it does mark the question as answered..... let me know ... View more

The multikv command takes tabular input (i.e. STDOUT from df) and extracts fields based on the header column (and you choice of fields). So you could use just ... *|multikv fields Used Type for your requested fields. PLEASE NOTE: the use of my "*|" should be replaced with your search for df related events. ... View more

GREAT! Happy to help ... View more

... for example... props.conf: [WMI:WinEventLog:Security] TRANSFORMS-security= events-null, events-filter transforms.conf: [events-null] REGEX = . DEST_KEY = queue FORMAT = nullQueue [events-filter] REGEX = (?m)^EventCode=(4624) DEST_KEY = queue FORMAT = indexQueue ... View more