Hi all Hope you can help! There is data in our Oracle audit file that we want to add to Fields. It has a Dollar sign, half way through, and it is giving me a bad character error. Here's an example of what is in the aud files: OS$USERID: [5] "FREDYF" Any thoughts on what I can do to make an exception and add this as a field? I entered the following in props.conf. [source::....aud] EXTRACT-osuserid = OS$USERID:(? [[0-9]+] "[^"]+") ... View more

We have a large number of audit files from Oracle that have been written to the Local OS. In the audit files there is a record of user ID's. However, these are used by large numbers of different users (up to 1800), and one file per login. During the data import, Splunk imported USERID as a searchable field, but not the trailing data in square brackets or username in quotes. Is there a way to leverage Splunk functionality and expand the searchable data and return an amalgamated report which shows one entry for each USERID over the specified time period. The end result should be one entry for each user that logged in over the last 90 days. Each user will have a different userid and name, but their relationship is constant. For example. USERID:[5] "JSMITH" USERID:[6] "HJONES" USERID:[7] "BCURRY" USERID:[8] "TDAVIS" Any help would be truly appreciated and success will be used to build a business case! Thanks ... View more