"resource_id": "/subscriptions/850686fe-9b2b-48ab-81a6-80600a0ca5z1/resourceGroups/vg-weu-ltaprod-rg/providers/Microsoft.Web/sites/abcProdUI", "metric_name": "AppConnections" "resource_id": "/subscriptions/da646143-7fd9-4219-bm72-bdd97951cf91/resourceGroups/gip-prod/providers/Microsoft.Web/sites/splunk-front-prod", "metric_name": "AppConnections" Below regex providing full extraction "resource_id\"\:[^,]*?(?<splunk_entity>\w+)" Currently extracting :abcProdUI & prod Expexcting to extact : abcProdUI & splunk-front-prod Any quick support is highly appreciated .     ... View more

I have multiple disk like C, D & E on server and want to do the prediction for multiple disk in same query. index=main host="localhost"  instance="C:" sourcetype="Perfmon:LogicalDisk" counter="% Free Space" | timechart min(Value) as "Used Space" | predict "Used Space" algorithm=LLP5 future_timespan=180 Could anyone help with modified query.     ... View more

I have two separate Splunk cloud instance and want to forward specific set of data from one instance to another. Please suggest the approach or any app/add-on available for this purpose.  ... View more

I want to transpose the below row to column. Host drive_Name utilization   aaa D 20   bbb D 30   aaa E 60     want to covert above table result as below. Host D E aaa 20 60 bbb 30   ... View more

Fields value of 2nd and 3rd events are enter changing. please suggest how to maintain order in Splunk status command. I can't use any other fields in stats by clause than token_id.   Sample Event: |makeresults |eval token_id="c75136c4-bdbc-439b"|eval doc_no="GSSAGGOS_QA-2931"|eval key=2931|eval keyword="DK-BAL-AP-00613" |append [| makeresults |eval token_id="c75136c4-bdbc-439b"|eval doc_no="GSSAGGOS_QA-2932"|eval key=2932|eval keyword="DK-Z13-SW-00002"] |append [| makeresults |eval token_id="c75136c4-bdbc-439b"|eval doc_no="GSSAGGOS_QA-2933"|eval key=2933|eval keyword="DK-BAL-AP-00847"] | stats values(key) as key values(keyword) as keyword values(doc_no) as doc_no by token_id | eval row=mvrange(0,mvcount(doc_no))| mvexpand row| foreach doc_no keyword key [| eval <<FIELD>>=mvindex(<<FIELD>>,row)]|fields - row Search Result output toke_id key keyword doc_no c75136c4-bdbc-439b 2931 DK-BAL-AP-00613 GSSAGGOS_QA-2931 c75136c4-bdbc-439b 2932 DK-BAL-AP-00847 GSSAGGOS_QA-2932 c75136c4-bdbc-439b 2933 DK-Z13-SW-00002 GSSAGGOS_QA-2933         Expected Output toke_id key keyword doc_no c75136c4-bdbc-439b 2931 DK-BAL-AP-00613 GSSAGGOS_QA-2931 c75136c4-bdbc-439b 2932 DK-Z13-SW-00002 GSSAGGOS_QA-2932 c75136c4-bdbc-439b 2933 DK-BAL-AP-00847 GSSAGGOS_QA-2933 ... View more

i want to create new index time field severity if raw json payload have level field value is Information. { "level": "Information", "ORIGIN_Severity_name": "CRITICAL", "ProductArea": "Application", "ORIGIN_Product": "Infrastructure"} What's wrong in my transforms.conf configuration. Any help much appreciated. transforms.conf [severity] REGEX = "level":\s\"(?<severity>\w+) SOURCE_KEY = fields:level FORMAT = severity::"INFO" WRITE_META = true   ... View more

Can i do the wildcard matching in lookup? |makeresults |eval ip=192.168.101.10 |lookup ip.csv ip output host In my lookup i have two entry ip=192.168.101.10 & ip=192.168.101.10/24. How can i add wildcard (*) for match and i should get two entry.   ... View more

I want to call lookup within case statement. if possible, please share sample query. ... View more

How can i Truncate the log description after 20 words in splunk and store in new field. ... View more