Hello, I have a field with this values /v1/accounts/96ea01b5-7ea7-4dc6-b534-39ae8b114bba/transactions /v1/accounts/ff572b85-c3c6-4e54-8343-75c5aa954285 /v1/accounts/469754d0-9169-45ca-af86-a885142d6ad4/transactions /v1/accounts/c68b8246-bd76-4d34-9d33-7fb4be4ebe9f/limits /v1/accounts/d9f1e948-e9aa-4a46-9e78-deeaf1d21143/limits /v1/accounts/f6fa235c-858d-42d2-80ae-85b12a750351 /v1/accounts/f4a0877f-5807-41ed-b7ee-c6be2e4e25be /v1/accounts/042c6b58-ea01-48cd-838e-06929b427f75 I need a query that show me only the lines that doesn't have nothing after the ID. Exemple  /v1/accounts/ff572b85-c3c6-4e54-8343-75c5aa954285 /v1/accounts/f6fa235c-858d-42d2-80ae-85b12a750351 /v1/accounts/f4a0877f-5807-41ed-b7ee-c6be2e4e25be /v1/accounts/042c6b58-ea01-48cd-838e-06929b427f75 Thanks ... View more

I have this log { [-]    duration: 3005    finishTime: 2021-08-25T15:47:26.838196    logger: splunk    startTime: 2021-08-25T15:47:23.832269    stepTransitionDuration: [ [+]    ]    traceSteps: [ [-]      { [+]      }      { [+]      }      { [+]      }      { [+]      }      { [+]      }      { [+]      }      { [+]      }      { [+]      }      { [+]      }      { [+]      }      { [+]      }      { [+]      }      { [+]      }      { [+]      }      { [+]      }      { [-]        logType: info        message: Response        res: { [-]          httpStatus: 400        }        timestamp: 2021-08-25T15:47:26.838195        title: Response      }    ]    xrayTraceId: }   How can i access only the last item (in bold letter)? I tried to access with mvindex but return blank results. ... View more

I have the follow query index=index |spath output=traceSteps path=traceSteps{} |table traceSteps |mvexpand traceSteps |rex field=traceSteps "(message\"\:\"(?<mensagem>(?<=\")(.*?)(?=\")))" |where mensagem LIKE "CPF%" |stats count when i change "|stats count" by "|timechart span=1d count" to show by date i have "no results found" Why? What do i make wrong? ... View more