The problem appears to stem from missing newlines before the timestamps.  Try these props.conf settings: [sourcetype::_json] SHOULD_LINEMERGE = false LINE_BREAKER = app_context=port_data"([\r\n]*)\d{2}\/\d{2}\/\d{4} ... View more

There is no such information in the event itself so just by pulling raw events from event log - no. You could manually define a calculated field in splunk but that would require quite a lot of work and would obviously only covet the cases known beforehand. Maybe, but I'm not an expert on windows here so it's a great "maybe" you could pull rendered events using custom script or program but then you'd get the data in format not conforming to that which Add-on for windows expects. It's simply that when working with windows events you usually search for event codes (regardless of whether you use splunk or any other tool). ... View more

where field is the name of the field you want the replacement done | eval field=replace(field,"\/Server","") ... View more

Just another doubt on the same kind here, what if all values do not have "open" and we will have to search to remove only the value "open" while retain its other fields and values? ... View more

@srinivas_gowda Try using the below rex: (?:[^,]+,){14}(?<alert_description>.*)\,\"Error In case you want to use in splunk query: | rex field = _raw "(?:[^,]+,){14}(?<alert_description>.*)\,\"Error" Also if this reply helped you in solving your problem, an up-vote would be appreciated. ... View more

Can you give examples of all the different sorts of events you want to extract fields from and highlight using different colours which parts belong to which belong to which fields using the same colour for the same field? The two examples given so far differ in that the second one does not have % in which is used in the first pattern to anchor the field. Unless they have common anchors across all events, you may not be able to extract from all the events with a common expression. ... View more

What extraction are you currently using? ... View more

In what way is it not working? Which fields are you not getting? Which events is it not working for? The more information you can give about your issue, the more likely we will be able to come up with a helpful answer! ... View more

Hi. I am not understanding the difference between the two searches. Can you share the exact settings in the saved search for the time? In case you have a personalized time setting to show you events in some specific time zone ( eg your events are in UTC but you want to see the time in terms of EST) you should know that the scheduled job times are with respect to this time zone setting of the user is the scheduled job.   ... View more

That's because you have an embedded , in the description. Try something like this: (?:[^,]+,){14}\"(?<alert_description>[^\"]*)\",.* ... View more

Your regex won't work for events which have commas in the values since every comma is treated as a field separator. You could try delimiter-based parsing. But if you really want a regex, you have to account for exceptions. You can try, for example, something like: (?:([^",]+|"[^"]*"),){19}"(?<instance>[^"]+)",.* Of course it's a raw regex, if you want to put it as a string into a command, you have to escape the quotation marks. ... View more

OK. So you're using a designated user, created specificaly for the installation of UF, right? This user most probably does not have sufficient permissions to read the Security Event Log. The easiest way to grant this user privileges to read all event logs is to add it to the "EventLog readers" local group. But it gives the rights to read ALL event logs which in your case might not be what you want. In order to selectively grant permissions to single event logs, you have to fiddle with registry entries and SDDL (ugly as hell, I admit) - https://docs.microsoft.com/en-us/troubleshoot/windows-server/group-policy/set-event-log-security-locally-or-via-group-policy ... View more

Quotation marks embedded in the rex command must be escaped with three backslashes. ... View more

@srinivas_gowda Use the below command in your search query     | regex field=_raw "Example(?<resource>.*?)\""     Also, If this reply helps you, an upvote would be appreciated.   ... View more

Hello, I am using 2 macros one for earliest and the other for latest. earliest=`Macro 1` latest=`Macro 2` followed by the query   Macro 1 contains -7d@d Macro 2 contains @m   We are using the macros as it is the standard for the project. I hope this clarifies. ... View more

Try return $Server at the end of the subsearch ... View more