Hi Splunk Community, I am working on a regex to filter the sources I am getting from logs. I am trying to drop everything after the last "/" in the field but I am having problems filtering. My current sources look something like: /db2audit/fs01/db2inst1/extract/abc123/file.del I am trying to filter it to look like: /db2audit/fs01/db2inst1/extract/abc123 Thanks in advance! ... View more

Hi Splunk Community, I am currently working with a search but I am trying to filter certain events out. I am trying to remove events with user=unknown and id=123456. When I do | where (id=123456 AND user!="unknown"), it removes both events with an unknown user and events with the id = 123456. I would like to keeps all other events with an unknown user and all other events from 123456 while only dropping events where user is unknown AND id=123456. Thanks in advance! ... View more

Hi Splunk Community, I have 2 tables I am attempting to merge together. Both tables are in csvs that I am trying to pull from. Does anyone know the command so that the data from the second table gets added to the bottom of the first? table 1                                           table 2 a1                                                    d4  b1                                                    e5 c3                                                     f6 Combined a1 b2 c3 d4 e5 f6                                     ... View more

Hi Splunk Community, I am trying to remove the data in a field after the first period. my field looks like this: 24611_abce.XXX.AAA.com 24612_r1q2e3.XXX.AAA.com null null 4iop45_q7w8e9.XXX.AAA.com hki90lhf3_m1n2b3.QQQQ.AAA.com   I would like to remove everything after the first period for every row but the pattterns at the end do not match after the first period. It should look like this:  24611_abce 24612_r1q2e3 null null 4iop45_q7w8e9 hki90lhf3_m1n2b3   thanks in advance! ... View more

I am currently working with DbConnect in order to send logs over to an Oracle db. I have a scheduled output set up on my heavy forwarder but it has not been sending logs to Oracle so I have been trying to debug it with the  dbxoutput command. In the search on the HF, I am running the search successfully and from what I am seeing, it should be sending the logs over. However, when I query the Oracle table on in the SQL Explorer, I do not see any new logs being shown in the table. Does anyone know where I can look on the CLI to see if there are any error logs associated with this output? ... View more

I am trying to separate multi value rows into their own rows. I have been trying to separate by adding a comma after the end of each row and then splitting them based on the comma, but I am only able to split the first repetition of the pattern. Can anyone help?   Example: I have rows like this: Domain Name Instance name Last Phone home Search execution time Domain1.com instance1.com                      instance2.com  instance3.com                      instance4.com 2022-02-28 2022-03-3   And I would like to transform them into this: Domain Name Instance name Last Phone home Search execution time Domain1.com instance1.com 2022-02-28 2022-03-02 Domain1.com instance2.com 2022-02-28 2022-03-02 Domain1.com instance3.com 2022-02-28 2022-03-02 Domain1.com instance4.com 2022-02-28 2022-03-02   ... View more