I have a query like this: 213123123-231231230342 | transaction startswith="user login process start" endswith="user login process end" Where it's returning the login flow for a given user. Similar to the out but below. How can I break all of the new lines in the results from the transaction into their own events? ... View more

Given the following log lines: Alpha Beta Gamma Hello World Soup I would like to query ` | first="Beta" | last="World" and get the following: Beta Gamma Hello World ... View more

I am looking to reformat my log output. Right now it's pretty messy and does not follow Splunks parsing format. What I would like to do is only log a JSON object a string, something like this: {"time":"2018-01-26 08:17:22.387","uuid":"13hiuh312-213e-134j-sdasj-dsadqweq","file":"main","fn":"load","message":"Hello World"} Or with a nested "Person" JSON object. {"time":"2018-01-26 08:17:22.387","uuid":"13hiuh312-213e-134j-sdasj-dsadqweq","file":"main","fn":"load","person":{"name": "thomas reggi", "age":"30"}} I found in the "Logging best practices" Page that it fields should be all caps and quoted in a totally different format. So I am interested in making the following change. TIME="2018-01-26 08:17:22.387", UUID="13hiuh312-213e-134j-sdasj-dsadqweq", FILE="main", FN="load", MESSAGE="Hello World" Or TIME="2018-01-26 08:17:22.387", UUID="13hiuh312-213e-134j-sdasj-dsadqweq", FILE="main", FN="load", PERSON={"name":"thomas reggi","age":"30"} I am curious if I need to have the PERSON JSON object at the enclosed in quotes, and if this is valid. ... View more