I have to remove a double inverted comma from a value. Query: | rex "(.Item=(?[^\,]+))"| rex "(.Reserved1=(?[^\,]+))" | rex "(.Reserved2=(?[^\,]+))" | rex "(.Type=(?[^\,]+))" | rex field=_raw "\d+\-\d+\-\d+\s+\d+\:\d+\:\d+\.\d+\,\s+\w+.*(?\"\d+\.\d+\")\,\s+\w+\s+.*" |rex field=_raw "\d+\-\d+\-\d+\s+\d+\:\d+\:\d+\.\d+\,\s+\w+.*(?\"\d+\.\d+\")\,\s+\w+\s+.*" I have to remove the double inverted comma from value below. I have written the above query, but the double inverted comma is not getting removed. Output: Line_Item “TFT Details Member” LG_Reserved1 “000000 “ LG_Reserved2 “0000” Balance_Test “Test“ Balance_Entered “1238996555” Balance_Test “8487347327473” ... View more

I want to extract Balance (Entered)="10008.1311701944" and Balance (Functional)="11648.1319999944" fields from below logs Log: GL Test="000000", GL Test2="0000", Balance Type="Debit", Balance (Entered)="10008.1311701944", Balance (Functional)="11648.1311701944" Command: index=test sourcetype="test" | rex field=_raw ".*\w+\s+\w+\=\"\d+\.\d+\"\s+[?\w+\s+\w+\"\d+\"\,\s+\w+]\s+\w+.*" ... View more

I have one Index that has two different sources. One source has current data and another has historical data. Both have the same fields. I want to append data current in historical data incase there are any changes in current data by user that should be reflected in historical data. I want one side current data in column, & on the other side, there would be historical data in another column. Trying below command source="historical" PERIOD="Q1" YEAR="2012" | Table PERIOD, YEAR | append [index=prod source="current" PERIOD="Q2" YEAR="2012" | Table PERIOD, YEAR] ... View more

Hi Team, I have PATA field which needs to do sum of PATA field, am using below command where should add PATA to get sum of PATA field index=pass source="test" |eval DATE = YEAR."-".PERIOD| fields DATE | stats count by DATE 2018-10-24 14:43:50.556, S_DATE="201208", SCENARIO="Actual", YEAR="2016", PERIOD="Feb", VIEW="YTD", ENTITY="109", ENTITY_DESC="Test Canada Inc.", MARKET="Canada", ACCOUNT="922002", ACCOUNT_DESC="922002 - Employee Activity Food Bev", INTER_ENTITY="[ICP None]", VALUE="[Parent Total]", RC="21102", SUBACCOUNT="000000", INTER_RC="000000", PRODUCT="000000", CUSTOM5="USD_FUNC_Total", DATA_TYPE="Total_Late", PATA="179.03919201" ... View more

We were using "servicesNS/lg/search/search/jobs/export" as servicepoint in test environment. Now, we have moved the same test configuration to Splunk Cloud. Kindly help me figure out how to find the service endpoint in Splunk for a new environment. ... View more

index=_internal | eval Mahesh=replace(date, "^(\d{1,2})/(\d{1,2})/", "\2/\1/") My date 03-16-2018 I need 16-03-2018 ... View more