NEVER let splunk build RegEx OR pick timestamps. Like this:
| makeresults
| eval _raw="{ \"__CURSOR\" : \"s=ccf7ccd2666b481c880c3a36c2d0d504;i=71c1b4;b=423aef85e8a745d785e26ea9b1611d92;m=9cd3993341;t=598cb4887fb24;x=29d41973a54be13c\", \"__REALTIME_TIMESTAMP\" : \"1575373746207524\", \"__MONOTONIC_TIMESTAMP\" : \"673564930881\", \"_BOOT_ID\" : \"423aef85e8a745d785e26ea9b1611d92\", \"_UID\" : \"0\", \"_GID\" : \"0\", \"_CAP_EFFECTIVE\" : \"1fffffffff\", \"_SYSTEMD_SLICE\" : \"system.slice\", \"_MACHINE_ID\" : \"6be70c13152f40488b5f3b3847dc2bd0\", \"_HOSTNAME\" : \"ocf-splunk-nonprod-linux-1\", \"_TRANSPORT\" : \"stdout\", \"PRIORITY\" : \"6\", \"_STREAM_ID\" : \"f5dbc3d1330f4783bf0586cfaad9a4fc\", \"SYSLOG_IDENTIFIER\" : \"polling_url.sh\", \"_PID\" : \"2345\", \"_COMM\" : \"cat\", \"_EXE\" : \"/usr/bin/cat\", \"_CMDLINE\" : \"/bin/cat\", \"_AUDIT_SESSION\" : \"8872\", \"_AUDIT_LOGINUID\" : \"0\", \"_SYSTEMD_CGROUP\" : \"/system.slice/crond.service\", \"_SYSTEMD_UNIT\" : \"crond.service\", \"MESSAGE\" : \"2019-12-03 05:49:05, Environment=\\\"OTS STRESS(CDC)\\\", Service=\\\"services-orderdetails-stress.apps.cdc-b.lle.xpaas.kohls\\\", WSDL_Service=\\\"KohlsOrderService\\\", Status=404, Response_Time=0.244, Endpoint=\\\""
| spath
| rex "\\\"MESSAGE\\\"\s*:\s*\\\"(?<message>.*)"
| rex field=message "Environment=\\\\\\\"(?<Environment>[^\\\]+)\S+\s+Service=\\\\\\\"(?<Service>[^\\\]+)"
... View more