I got to extract some fields of a JSON log.  Log buildup eksample: {"name":"cookie","Value":"Foo"} {"name":"cookie","Value":"Bar"} {"name":"cookie","Value":"Foobar"} The problem is that I got several loglines that all is called "cookie" but have different values, and I need to extract a mulitvalue field "cookie" with all the different values as a multivalue field. But not every logentry is like this, some is just one "cookie" entry. This is the regex string I'v used, but then the value of the "cookie" field only contains the first cookie record from the log.  | rex field=_raw "\Sname\S{3}cookie\S{3}\w{5}\S{3}(?<h2_cookie>[\w\=\-\+\.\&\;\s]*)" ... View more

I need to get a list of all users that haven't changed password (Windows) in a set timespan. Timespan exceeds length of splunk logdata. I have made a search to give me usernames of all successfull logins, and another search giving me usernames of users that has changes passwords. But I can't figure out a way to compare the two results in a way that gives me a listing of all the usernames that is in the user login list, but not is in the user changes password list. Any suggestions to get this compare to work is much appreciated, If I'm way of on my search please enlighten me. This is the search I have so far. index=winevents (EventCode=4723 OR EventCode=4724) Keywords="Audit Success" | eval User=mvindex(Account_Name,1) | dedup User | search User!=$ | sort User | rename User AS User_PW | table User_PW | append [ search index=winevents EventCode=4648 Keywords="Audit Success" | eval User=mvindex(Account_Name,1) | dedup User | search User!=$ | sort User | rename User AS User_Login | table User_Login] ... View more

We got several IIS servers and want to index IIS logs into Splunk. However, we need to seperate some of the servers to a seperate indexer due to different needs for Access controll and retention. Is there a way to get IIS logs from some servers to one index and logs from anorther server to another index? Using universal forwarders. running Splunk 7.2.6 , Windows 2012RS, single instance. ... View more

I need to set up an splunk test environment to test out apps before adding them to production environment, also to test out adding new data into new indexes before adding it to production. We run an splunk enterprise 7.3.1, all in one single instance on a physical server. My plan for the test environment is to set up a standalone splunk installation with the free 500MB/day license and test the new stuff. Does any of you have any experience with something similar? Can I get the universal forwarder on a few servers to send data to two splunk servers, In the docs on the universal forwarder I understand that there is a support for loadbalancing between several indexers, but it seems like it will send to either and not both. ... View more

Upgraded from 6.1 to 7.0 and now none of my old searches gives any results i.e dashboard searces. As a Splunk rookie I have noe clue as where to start looking. When searching for * I get a few results, but only from active directory. A search for EventCode gives no results. Running splunk on a one-server setup, only collectiong windows event data. Anyone have a clue where to start? ... View more