Hello together, i use splunk the version 7.2.4.2 and had the following issue by creating a dynamic field exctration. This is a Event Example: ##### BEGIN EVENT ##### Mode UPDATE ----- END OF FIELD ----- Identifier probe_connection_event:A1:servername123:65:PROBE:: ----- END OF FIELD ----- Serial 1234567891 ----- END OF FIELD ----- Node servername123 ----- END OF FIELD ----- NodeAlias ----- END OF FIELD ----- Manager Bus Self Monitoring @A1 ----- END OF FIELD ----- Agent SelfMonitoring ----- END OF FIELD ----- AlertGroup ConnectionStatus ##### END EVENT ##### So the field construction is the following one: <field name> [single line] <field value> [multi line or empty] ----- END OF FIELD ----- [OR] ##### END EVENT ##### For that i created with regex101 the following regex: (?m)(\#\#\#\#\#|\-\-\-\-\-)$(\r\n|\r|\n)^(.*)$(\r\n|\r|\n)?^([\s\S]*?)(\r\n|\r|\n)?(\#\#\#\#\#|\-\-\-\-\-\ END\ OF\ FIELD) When i test the regex against a small set it extracts me the first correct: /opt/splunk/bin/splunk cmd pcregextest mregex='(?m)(\#\#\#\#\#|\-\-\-\-\-)$(\r\n|\r|\n)^(.*)$(\r\n|\r|\n)?^([\s\S]*?)(\r\n|\r|\n)?(\#\#\#\#\#|\-\-\-\-\-\ END\ OF\ FIELD)' test_str="##### BEGIN EVENT ##### > Mode > DELETE > ----- END OF FIELD ----- > ServerSerial > 86919394 > ----- END OF FIELD ----- > ServerName > AA1 > ##### END EVENT #####" Original Pattern: '(?m)(\#\#\#\#\#|\-\-\-\-\-)$(\r\n|\r|\n)^(.*)$(\r\n|\r|\n)?^([\s\S]*?)(\r\n|\r|\n)?(\#\#\#\#\#|\-\-\-\-\-\ END\ OF\ FIELD)' Expanded Pattern: '(?m)(\#\#\#\#\#|\-\-\-\-\-)$(\r\n|\r|\n)^(.*)$(\r\n|\r|\n)?^([\s\S]*?)(\r\n|\r|\n)?(\#\#\#\#\#|\-\-\-\-\-\ END\ OF\ FIELD)' Regex compiled successfully. Capture group count = 7. Named capturing groups = 0. SUCCESS - match against: '##### BEGIN EVENT ##### Mode DELETE ----- END OF FIELD ----- ServerSerial 86919394 ----- END OF FIELD ----- ServerName AA1 ##### END EVENT #####' #### Capturing group data ##### Group | Name | Value -------------------------------------- 1 | | ##### 2 | | 3 | | Mode 4 | | 5 | | DELETE 6 | | 7 | | ----- END OF FIELD My Props.conf is the following one: [custom_sourcetype] SHOULD_LINEMERGE=true NO_BINARY_CHECK=true CHARSET=AUTO TRUNCATE=512 category=CUSTOM disabled=false pulldown_type=true MAX_EVENTS=4096 BREAK_ONLY_BEFORE=\#\#\#\#\ BEGIN\ EVENT\ \#\#\#\# REPORT-omnifields=omnifieldsExtract And my Transforms.conf: [omnifieldsExtract] REGEX = (?m)(\#\#\#\#\#|\-\-\-\-\-)$(\r\n|\r|\n)^(.*)$(\r\n|\r|\n)?^([\s\S]*?)(\r\n|\r|\n)?(\#\#\#\#\#|\-\-\-\-\-\ END\ OF\ FIELD) REPEAT_MATCH = true FORMAT = $3::$5 The transforms and props configuration are stored on the search head cluster. So my opinion is now for the event example that i get the following fields: Field Name: Mode Value: UPDATE Field Name: Identifier Value: probe_connection_event:A1:servername123:65:PROBE:: Field Name: Serial Value: 1234567891 Field Name: Node Value: servername123 Field Name: NodeAlias Value: Field Name: Manager Value: "Bus Self Monitoring @A1" Field Name: Agent Value: SelfMonitoring Field Name: AlertGroup Value: ConnectionStatus But actually i get no single field. I didnt know what i am missing or maked false. Had anyone a idea? Thanks for your help 😄 ... View more

Hello together, I probe to get the active session count from our asa logs per minute. I created a datamodel (CASA) which contains the username and also the session_duration field if the session is closed. A session can only timeout after 15 minutes, if no packet arrives by the vpn gateway. Also, a session can be active over years, so the correlation from session start and logout events are not possible. Actually i had this: | tstats estdc(ASA.Username) as UsrC count(ASA.session_duration) as LogC from datamodel=CASA where (nodename = ASA.VPN) groupby _time, host prestats=false span=15m | eval "Active Sessions"=UsrC - LogC time | host | UsrC | LogC | Active Sessions 23:00 | vpnhost1 | 103 | 15 | 88 23:15 | vpnhost1 | 99 | 15 | 84 23:30 | vpnhost1 | 85 | 11 | 74 23:45 | vpnhost1 | 82 | 11 | 71 I think the solution would be that every minute he count and dedup the field ASA.Username for the last 15 minutes. But actually, I have no idea to solve this. Did anyone have a solution to my problem or need additional information to help? ... View more