I am looking to strip out some text from a field in my log file and have no knowledge of regex to do it. What I would like is the get "richf" out of the following entry by setting up a field "loguser" then removing "logname" from it. I have lots of other linux machines that use the field "user" and have a diferent format when searching for "richf" in the interactive field editor "user" and "richf" are highlighted and not the logname=richf. May 30 12:02:58 revmq su: pam_unix(su-l:auth): authentication failure; logname=richf uid=502 euid=0 tty=pts/1 ruser=richf rhost= user=root May 30 12:02:56 revmq sshd[5165]: pam_unix(sshd:session): session opened for user richf by (uid=0) May 30 12:02:56 revmq sshd[5165]: Accepted password for richf from 10.77.113.237 port 5718 ssh2 ... View more

I have an install of splunk 5.0.1 that was using an old lea-loggrabber app. I have installed the new Splunk support LEA grabber for OPSEC and now seem to have issues with my logs not showing anymore. I can see from tcpdump that the logs are being sent to the splunk server, however they do not show in splunk search. Also when trying to perform a search now I get the following errors "Error 'Could not find all of the specified lookup fields in the lookup table.' for conf 'opsec' and lookup table 'checkpoint_action_lookup'. ... View more