Your regex also extracted the timestamp, but as with mine, the whole log was one event with this timestamp. It is a textfile, separators are spaces. Example given below: 2014-10-21 05:01:52.964 INFO at.bcm.skeis [serverScheduler_Worker-1] import successful 2014-10-21 05:01:54.538 INFO at.bcm.skeis [serverScheduler_Worker-1] Reports successfully imported 2014-10-21 05:01:56.586 INFO at.bcm.skeis [serverScheduler_Worker-1] Error during import! 2014-10-21 05:01:58.560 INFO at.bcm.skeis [serverScheduler_Worker-1] 2014-10-21 06:03:44.307 INFO at.bcm.skeis [serverScheduler_Worker-5] import successfull and how come, that the time is not extracted correctly? I mean there is a difference between October 2014 and September 2009 - I can't explain that. ... View more

You can find it out by copying that section in regex101.com and playing around. I found this: During searchtime: | rex "name:\s(?<DBname>\S+)" Or in the field-extractor (?m)name:\s(?<FIELDNAME>\S+) ... View more

In props.conf Using EXTRACT-to = \sTo:\s(?\S+) is working well 🙂 Using EXTRACT-from = \From:\s(?\S+) is showing as | from_addr=<> when searching? Some are working but majority are showing bank. ... View more

Here is the regex for extracting the field with the Field Extractor (Hits): (?i) ABC : (?P .+) And here is the statement I put in the search field: | table date_month date_mday date_hour date_minute Hits | delta Hits as tempdiff | eval Difference=tempdiff*(-1) I am first creating a table to display the time and the extracted field, which I called "Hits". Then I calculated the difference using the delta command. To remove the negative prefix, I multiplied the field with -1. ... View more

Is there a way for not renaming the series? because splunk gives the color basing on the name and I have other charts and the with the same series and i would like to maintain the same colors. ... View more

That was my first thought as well. But I have way too many fields to do this manually in each report. Is there documentation on how to define and use lookups for field renaming? I tried finding in Splunk Docs but couldn't get anywhere. And also regex renaming (like replace _ with space, make first letter capital for each word etc.) ... View more

@nasrinmulani This thread is nearly 4 years old with an accepted answer so you're unlikely to get many responses. I suggest you post a new question describing your problem. Reference this answer if you wish. ... View more

I recommend using either of the following sites to test your regex. If you load a few example logs there you can see how well it matches. http://regex101.com http://www.regexr.com/v1 The other way is to pull your regex out of the transforms and pop it into your search ala ... | rex "<your regex>" | table <rex defined field> _raw if wanted to get crazy you could do something like the following as it is usually the punctuation that throws of rex statements (maybe just mine =). ... | dedup punct | rex "<your regex>" | table <rex defined field> _raw The other issue is one of permissions but that is a harder nut to crack. ... View more