We have two indexers, one version 8.1.5 (which will not be updated soon) and version 9.1.0.1 I see 9 has a nice feature "Ingest actions" which is exactly what I need to mask some incoming Personal Information (PI). It is coming in JSON and looks something like: \"addressLine1\":\"1234 Main Street\", I need to find some fields and remove the content. Yes I believe there are backslashes in there. I tested a regex on 9 and added to the transforms.conf and props.conf files on our 8.1.5 indexer but the rules didn't work. In one of my tests the rule caused an entire log entry to change to "999999999", not quite what I was expecting but now we know Splunk was applying the rule. This is one of my rules that had no affect: [address_masking] REGEX = (?<=\"addressLine1\":\")[^\"]* FORMAT = \"addressLine1\":\"100 Unknown Rd.\" DEST_KEY = _raw Found docs, looking at them now: Configure advanced extractions with field transforms - Splunk Documentation Can I get someone point out what is wrong with the above transform? Thanks!     ... View more

As I understand the documentation ANDs are implied, so "eventtype=A eventtype=B"  is the same as "eventtype=A AND eventtype=B"  Also, if the tag names are the same like in this case it is interpreted as "eventtype=A OR eventtype=B". So my question is "eventtype" a tag name or not? If I do a search the search results say eventtype is both A and B! I don't understand. ... View more

I'm stuck with an old Splunk system 8.1.5 and trying to move Alerts and Reports to a new system (9 something).  I figured maybe I could use the API, GET works: curl -k -u myusername:mypassword https://vs-iapp001.local:8089/services/saved/searches/GerrysTestReport -H "Authorization: Bearer mytoken" which returns a lot of XML that I save in a file called GerrysTestReport.xml Then I deleted my report and now I'm trying to recreate it using POST curl -X POST -k -u myusername:mypassword https://vs-iapp001.local:8089/servicesNS/splunk/App/saved/searches/_new/GerrysTestReport -H "Authorization: Bearer mytoken" --data-urlencode @GerrysTestReport.xml Unfortunately it just returns errors like "Action forbidden" The parameters URL are just too complicated to figure out, and I have tried many, many combinations. Nothing works. My account is an admin account and I have every available privilege ... View more