Re, I tried that to remove the timestamp and it's work now but don't know if it's correct or if I need to optimse that ?      Regards,     ... View more

Hello, I just tried to remove the entire timestamp before the json data and it's work      But how can I remove the timestamp for all query with different timestamp ?    Regards, ... View more

Hello I just tried the rex but I still not json format, Do I need to export the query in json or something like that ?          Regards, ... View more

Thanks, I did the change, I get the value below but it isn't in json format ? each value still in the same field (like @idfacture; @idfactureABC; @routename)   Regards,   ... View more

Hello, Thank you for your help, I appreciate. I m trying to explain what I want  1. We send json logs to a Mysql DB from an application server -> this is the logs format from the application server -->  {"bam":{"facture":{"@idFFFFF":"","@idBBBBB":"","@idCCCCC":"","@idCCCCC":"","@ABCACB":"","@status":""},"Contact":{"@idContact":"","@nom":"","@prenom":"","@adresse":"","@typeContact":""},"service":{"@jobName":"XX_Abcdef_Abccc_Token_V1","@jobVersion":"x.x","@routeName":"","@routeVersion":"","@currentTime":"2023-07-03 13:00:28","@idCorrelation":"545454ssss-abcc-456ss-5454-444455555554444","@serviceDuration":"1140"}}} If I copy this ligne on notepad and manually import it on splunk I get want I want to have (I used the default source type) Each value is extracted so it's perfect   2. To automatiquely get the new logs from the DB server I decided to use Splunk DB connect ( maybe it's not the best choice ? ) So I configured a new input in the Splunk DB connect to get the value from the DB table    But now the data are not indexed on json format as shown below   How can I get these datas on json format as shown on the first and second capture ?  Hope iyou understand better what I m trying to do    Regards,       ... View more

Hello, Thank you for your reply but it doesn't work 😞 Maybe it isn't possible to convert the JSON data that I got from DB connect 😕  ... View more

Hi, thx for your reply but the result it's same, all events are merged ... View more

Hello,   Thank you for your answer, I will you explain my case better. I have two CSV file with csv file A where the content is some CVE vulnerability by ip server and the second CSV file B where the content is the list of our server where is mentionned the server owner etc.  I want to show on the dashboard the Owner, name server, CVE, IP ect.  In the csv file A the Owner is not associed with the IP server so I did an variable "ip" to merge the data from both CSV and get the owner associed with the IP with "transaction" (index="A" AND (Risk=$Risk$))OR(index="B" AND ("Deployment State"=Production))| eval ip_extracted=if(cidrmatch("Network",extracted_Host), "ipok", "noip") | eval ip_servers=if(cidrmatch("Network",NIC__1__IPAddress__1), "ipok", "noip") | eval ip=if(match(ip_servers, "ipok"),NIC__1__IPAddress__1, extracted_Host) | transaction ip | table Owner ip Risk Name Description Solution "CVSS v2_0 Base Score" "CVSS v3_0 Base Score" OperatingSystem | where Risk!="NULL" |search Owner=$Owner$ ip=$ip$   Now my problem is that each events sorted by ip are merged in my dashboard, I want that each event is shown independently by ip like as shown below because I want to add an check case where the owner can check if the event has been done or not and actualy it's not possible because each events are merged   My English is not good so I don't know if you have understand what I mean ?   Regards,   ... View more

Hello,   I'm looking for the same use case, have you find an solution for that ?    Regards,   ... View more

thx 😃 ... View more

Hi I've the same issue, could you show me where do you place the "makeresult" please ?    | appendpipe [stats count | where count=0]   Regards, ... View more

Hi, I have a last request, now I'm going to try to get a specific message_id and his value "message" I added the value in the stats count value as below but I get all message and message ID I can't sort by message id with the field "where" Do you have any idea about that ?   index="index_XX" partition="/Common/XXXXXXXX:Common" | stats count values(client_info_host) as client_info_host values(user) as user values(message) as message values(message_id) as message_id by session_id | dedup user | where message_id="0505" | table session_id user client_info_host message_id message       Regards,   Miguel   ... View more

Hello, Cool, yes it's work thank you 😁 if I want tu show the connexion time Do I need tu insert the field "_time" after the "by session_id" ? and in the table   Regards ... View more

Hello Thank you to answer, Yes I can find event with this field but the username isn't in the same event. The only same value that I can find in all event is the session id field   Regards, ... View more

Hello thank you for your reply, I tried your suggestion but I get the username and session id but not the client_info host 😕 😭     P.S: The  client_info host data is not in the same event that the username, but the session id is in all events. Regards, Miguel ... View more

Hello,   Thank you, it's work perfectly 😃 ... View more