Newbie in Splunk here. How do I extract the value zzz@zzz.com(at the end of the below payload) in a new field named "user"?     POST /xxxxx/xxxx/xxx/xxxxx HTTP/1.1\r\nHost: xxxx.xxxx.com\r\nConnection: Keep-Alive\r\nAccept-Encoding: gzip\r\nCF-IPCountry: US\r\nX-Forwarded-For: 1.1.1.1, 2.2.2.2\r\nCF-RAY: 715ae60ec98f02ce-MIA\r\nContent-Length: 37\r\nX-Forwarded-Proto: https\r\nCF-Visitor: {""scheme"":""https""}\r\nsec-ch-ua: "" Not A;Brand"";v=""99"", ""Chromium"";v=""101"", ""Google Chrome"";v=""101""\r\nsec-ch-ua-mobile: ?1\r\nauthorization: *************\r\ncontent-type: application/json\r\nbundleid: com.xxx.xxxxx\r\naccept: application/json, text/plain, */*\r\nsecurekey: Sssssss==\r\nuser-agent: Mozilla/5.0 (Linux; Android 12; SM-A326U) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.0.0 Mobile Safari/537.36\r\nsec-ch-ua-platform: ""Android""\r\norigin: https://xxx.com\r\nsec-fetch-site: cross-site\r\nsec-fetch-mode: cors\r\nsec-fetch-dest: empty\r\nreferer: https://myxxx.com/\r\naccept-language: en-US,en;q=0.9\r\nCF-Connecting-IP: 1.1.1.1\r\nCDN-Loop: cloudflare\r\n\r\n{""user"":""zzz@zzz.com""}       ... View more

Hello - I am a Splunk newbie. datetime Src_machine_name Col1 Col3 1/1/2020 Machine1 Value1 Value2 1/2/2020 Machine1 Value1 Value5 1/31/2020 Machine3 Vavleu11 Value22 2/1/2020 Machine1 Value1 Value2 2/2/2020 Machine2 Value1 Value5 2/28/2020 Machine3 Vavleu11 Value22 I want to get sum of all counts of all machines (src_machine_name) for every month and put that in a bar chart with Name of month and count of Src_machine_name in that month. So in january 2020, total count of Src_machine_name was 3, in Feb It was 3. This is what I started with. index="test |  stats count by Src_machine_name Will appreciate any help ... View more