Dear Splunker i need a search that gets me if  theres a host that has these logs, below is a psudeo search that show what i really want: index=linux host=* sourcetype=bash_history AND ("systemctl start" OR "systemctl enable") | union [search index=linux host=* sourcetype=bash_history (mv AND /opt/ ) ] just to make more clearer, i want a match only  if a server generated a log that contains "mv AND /opt/" and another log that contains "systemctl start" OR "systemctl enable"       thanks in advance ... View more

hello Splunkers i have a requirement where i need to show values in statistics even if it doesn't exist, for example here's my search: index=brandprotection name IN (ali, ahmad, elias,moayad) | stats count by brand however sometimes in the logs Elias and Moayad names isn't there but i need to have it in the table, so i need the output to be like this   user count ahmad 7 ali 4 elias 0 moayad 0   i need a search that would show the results like the table above.     thanks ... View more

Hello Splunkers   i need your help in creating a search to count number of alerts by months that would fit in a column chart     thanks ... View more

Hello Splunkers,    i want to to extract a 10-digit path from a url but unfortunately i always get this error: Error in 'rex' command: The regex '.*\/(([0-9a-z]{10}))' does not extract anything. It should specify at least one named group. Format: (?<name>...).   how ever, i want to extract the path from this URL  https://example.com/8a2a6063b3 this is the search i used   index=FP_proxy | rex field=url "http[s]?:\/\/[a-zA-Z0-9-]{1,}\..*\/(([0-9a-z]{10})?<url__path>)" your help is much needed and appreciated to fix this issue       ... View more