Yes, you can do in multiple ways Configure logstash send the data over to Splunk using tcp output plugin and create tcp input on Splunk On logstash use http output plugin to send to Splunk Config logstash to write the events to log file and have Splunk forwards to read and send to Splunk indexes ... View more

You know the country code is always 1 (if present) 1?(?<ph_num>\d{10}) ==> This should return 10 digit irrespective whether country code 1 is prefix or not. \d*(?<ph_num>\d{10}) ==> This return last 10 digits from phone number irrespective of whether the country code is 1 or 22 or 100 or not prefixed. ... View more

You need put configuration similar to below in props.conf against the sourcetype props.conf [sourcetype] SHOULD_LINEMERGE=TRUE BREAK_ONLY_BEFORE = Entering: TIME_FORMAT = %Y-%m-%d %H:%M:%S %3N MAX_TIMESTAMP_LOOKAHEAD = 500 TIME_PREFIX = StartTime: Note: I have not tested it and it should work fine. The above configure merges the multi lines event into single line and break the individual event at "Entering:" ... View more

Your join syntax is incorrect it should be ... | join eventid [search index=ap...... ] So finally your query looks like: index=app_sec_prod sourcetype="mcafee:emailgateway:file" host="portal4.visa.com" |rex "(?i)^(?:[^\|]*\|){2}(?P[^\|]+)" | fields eventid | join eventid [search index=app_sec_prod sourcetype="mcafee:emailgateway:file" host="portal4.visa.com" "Quarantined by Content Filtering" | rex "(?i)^(?:[^\|]*\|){2}(?P[^\|]+)" | fields eventid ] ... View more