Hello team ,   I am having one event in which single field have multiple value like provided below:   {"body":{"records": [{ "category": "AzureFirewallNetworkRule", "time": "2021-04-26T13:13:37.0631470Z", "resourceId": "/SUBSCRIPTIONS/**********-*****-****-**/RESOURCEGROUPS/C-ABS-IT-SS-PROD-UKS-RG/PROVIDERS/MICROSOFT.NETWORK/AZUREFIREWALLS/C-ABS-IT-SS-PROD-UKS-FIREWALL", "operationName": "AzureFirewallNetworkRuleLog", "properties": {"msg":"TCP request from 10.119.252.16:64967 to 54.83.8.19:54443. Action: Deny"}},{ "category": "AzureFirewallNetworkRule", "time": "2021-04-26T13:13:37.4217670Z", "resourceId": "/SUBSCRIPTIONS/**********-*****-****-**/RESOURCEGROUPS/C-ABS-IT-SS-PROD-UKS-RG/PROVIDERS/MICROSOFT.NETWORK/AZUREFIREWALLS/C-ABS-IT-SS-PROD-UKS-FIREWALL", "operationName": "AzureFirewallNetworkRuleLog", "properties": {"msg":"TCP request from 10.119.34.12:62142 to 131.100.0.201:5938. Action: Deny"}},{ "category": "AzureFirewallNetworkRule", "time": "2021-04-26T13:13:37.9262290Z", "resourceId": "/SUBSCRIPTIONS/**********-*****-****-**/RESOURCEGROUPS/C-ABS-IT-SS-PROD-UKS-RG/PROVIDERS/MICROSOFT.NETWORK/AZUREFIREWALLS/C-ABS-IT-SS-PROD-UKS-FIREWALL", "operationName": "AzureFirewallNetworkRuleLog", "properties": {"msg":"TCP request from 10.119.252.196:13973 to 40.79.154.87:443. Action: Allow"}} Above is one single event from which i want to extract src ip and dest ip  for example 10.119.252.16 is src ip and 54.83.8.19 is dest ip , I want to extract all from backend i dont wana use  rex max_match=0 .   Please let me know how can i extract all from backend .   Thanks Kannu ... View more

Hello Guys , I have one json event in which there is subarray so i want to create one field which will have first index value of array for example { "data": {"task":"pullFrom", "from_repo":"https://abc.mxz.com:8089", "to_repo":"https://abc.mxzz.com:8089", "to_repo_change_count":20008, "asset_uri":["kannu","search","ui-prefs","search"] } } in above event i wnat to create the field which will have value only "kannu" from subarray "asset_uri" . I tried doing data.asset_uri[0] as a normal json parsing but splunk is giving error while doing like this Thanks in advance ... View more

Dear splunkers , I want to monitor my universal forwarder agent license expiry date . I am able to monitor it for linux system using scripted input on "openssl x509 -in /opt/splunkforwarder/etc/auth/server.pem -noout -enddate" But how to do the same with windows system , please help Thanks Manish Kumar ... View more

Hello Splunkers , I have one csv file which gets dumped to location being monitored by splunk UF . That csv contains content like this 19752,"TTYHUJIKNN",sdfsdfsdfsdfwer,sdfsdfsdf,,,"04-04-2019 12:11:31 PM","06-14-2019 09:30:18 AM" Time stamp present in above logs will get changed when every time CSV get appended by new entry of logs , But i dont want splunk to indexed the event based on timestamp present in logs , i want data to get indexed with the time of creation of file like provided below it should be Jul 9 01:28 -rwxr-xr-x 1 ccc ccc 13308953 Jul 9 01:28 Device_Report07-09-2019.csv -rwxr-xr-x 1 ccc ccc 13311527 Jul 10 01:27 Device_Report07-10-2019.csv For achieving this i have used props.conf at UF end . TIME_PREFIX = ^ MAX_TIMESTAMP_LOOKAHEAD = 1 But its not working as expected , Please help ... View more