Looking at the code.  /opt/splunk/etc/apps/splunk_ta_o365/bin/3rdparty/certifi/cacert.pem does not get referenced anywhere. There is only a comment to. but no actual code to do it.   ... View more

Why not just use extract? | makeresults | eval _raw="rtpmap:8 PCMA/8000,rtpmap:101 telephone-event/8000,maxptime:20,ptime:20" | extract pairdelim=",", kvdelim=":" mv_add=t ... View more

Store the list of hosts in an eventtype. https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Abouteventtypes [special_hosts] search = ( index=foo host="bar1" OR host="bar2" OR host="bar3" OR host="bar4" OR host="bar5" OR host="bar6" OR host="bar7" OR host="bar8" ) then just search eventtype=special_hosts ... View more

Try ... | eventstats count AS Total by oneOfTheFieldNames ... View more

You can try using spath to parse it first. Then pull out the fields. | makeresults | eval raw="{ \"computer\": { \"extension_attributes\": [ { \"id\": 1, \"name\": \"xxx-enrolled\", \"type\": \"String\", \"value\": \"3\" }, { \"id\": 7, \"name\": \"xxx-filevault\", \"type\": \"String\", \"value\": \"FileVault is On.\" }, { \"id\": 4, \"name\": \"xxx-initial-hostname\", \"type\": \"String\", \"value\": \"xxxx-2i3l\" }, { \"id\": 5, \"name\": \"Host name\", \"type\": \"String\", \"value\": \"xxxx-2i3l\" }, { \"id\": 2, \"name\": \"Last User\", \"type\": \"String\", \"value\": \"\" }, { \"id\": 5, \"name\": \"xxx-enrolled\", \"type\": \"String\", \"value\": \"10\" }, ] } }" | rename raw AS _raw | spath | rename computer.extension_attributes{}.name AS name | stats count by name ... View more

What about not using regex at all and use xpath? | makeresults | eval raw="123 ABC SE Information" | rename raw AS _raw | xpath "/Val[3]" outfield=blah ... View more