Trying to Pick domainType and domainName from below log using the below regex: It works in regex101 but not in Splunk, it gives a blank column. domainName - rex"(?:domainName\\\"\:\\\")(?<domainName>([a-zA-Z0-9-\.]+))"  domainType - rex"(?:domainType\\\"\:\\\")(?<domainType>\w)" "payload":"{\"domainType\":\"L\",\"modifiedBy\":\"\",\"relayHost\":\"\",\"rewriteDomain\":\"\",\"wildcardAccount\":\"\",\"domainName\":\"xxx.yyyyy.com\"}"},"encoding":null,"contentType":"application/json","responseCode":null}   ... View more

I have a query which extracts counts for last 30 days. But the dates are not in proper order in result. index = *** "search phrase" | stats count by date_mday | rename date_mday as Date If i make a search today for last 30 days, the result should be in the below order . 01/18, 19, 20 .......... 02/16,02/17. ... View more

Log looks like this. {...\"Key_name\":\"Value\",....}, {...\"Key_name\":\"Value\",....}, {...\"Key_name\":\"Value\",....}, {...\"Key_name\":\"Value\",....}, My query now extracting the first field alone. I've created a query which extracts all 4 value using append search with subsequent string from each row but the search takes lots of time since it involves 4 append search. All i need now is to fetch all 4 value into the column key_name in a single query. ... View more

I have a report generated with following fields, Field 1 , Field 2, Field 3. I have to create an alert based on the Field 1(it's a phone number field which consists 0-9 , - , +, *) value satisfying below condition. • Number starts with 101 and is greater than 5 digits • Number starts with *xy101 and is greater than 8 digits • Number starts with *xy011 and is greater than 8 digits ... View more