Dears    I need your help in extracting the domain and top level domain from dns queries where:   Query Field                  |         extracted field Account.fb.com         .         Fb.com Aa.bb.cc.com              .         Cc.com Www.google.com      .        Google.com       Thanks in advance  ... View more

hi, i want to extracted the first word from each variable the index has a field called search_name which has these variables:   Risk - 24 Hour Risk Threshold Exceeded - Rule Endpoint - machine with possible malware - fffff Network - Possible SQL injection - Rule   i want to perform a regex to extracted the first word out of each variable so the output would be:   risk endpoint network         thanks ^_^ ... View more

Hello Splunker   usernames in my environment are shown as  : user=Company\username@AD#   where the # is a number and some users are shown as: user=Company\username$@AD#   the username has many variations" only numbers only letters combination of both   i want to extract only the username with the other letters   thanks ^_^ ... View more

Hello Splunkers   i want to print events for only the users who has failed login attempts but never allowed attempts. here's my search index=MyApp eventype=authentication action=fail user=* but this one prints all failures even if they have other successful attempt. i only want users with only failed attempts without other successful attempts, i hope the picture below clears things: green: user only have successful logins Yellow: user have both successful/failed logins Red: user only have failed logins   i want the red area only   Thanks ... View more

Hello Splunkers   in my firewall logs, i have three numerical fields, (out_packet, in_packet, bytes)   i want to sum these values each field individually but a i want the answer in one record for example: index=firewall | timechart sum (bytes) as bytes , sum (in_packet) as in_packet, sum (out_packet) as out_packet   unfortunately it didn't work, please help me with it   Thanks ^_^ ... View more

hello splunker !   in splunk, i want to print top email sender by the number of attachment, my command is: index=emaileventtype="email-events" action=delivered | top 10 sender by AttachCount but it produces more fields and they aren't sorted, like this: and as you can see that it produced more than 10 values i've also tried: index=emaileventtype="email-events" action=delivered | top 10 sender by AttachCount | stats sum(AttachCount) as AttachCount by sender | top 10 AttachCount   and here's the result:     please help me, i need two fields only, top sender by AttachCount      Thanks ... View more