I have a JSON file, which is being indexed by Splunk, the format is like - { testdata : [ { "testid" : 1234, "abc" : "def", "def" : "abc", "httpServer" : [ { "responseTime" : 300, "responseCode" : 200, "datetime": 0982894965 }, { "responseTime": 312, "responseCode": 200, "datetime": 09230948509 } ], "transactions" : [ { .... }, { .... } ] }, { "testid": 1234, .... } ] } Can someone please suggest a regex which can give me relevant data for every "testid". Whatever regex I tried doesn't seem to work. I was using this stanza in my props.conf [randomsourcetype] [accountgroups] TRUNCATE = 0 KV_MODE = json NO_BINARY_CHECK = true SHOULD_LINEMERGE = true LINE_BREAKER = ([\r\n]*)(?=\{) DATETIME_CONFIG = CURRENT Thanks in advance ... View more

Hello fellow Splunkers, I am using the following query to fetch the splunk app name in standalone search head - | rest /services/search/jobs splunk_server=local | addinfo | where sid = info_sid | rename eai:acl.app as app_name | fields + app_name However, this same query is not working in SHC. It shows No results found Any suggestions would be appreciated. Thanks! ... View more

I am using OpsGenie splunk integration for the voice call and sms alerts feature to notify when splunk triggers an alert however I am getting the below error in splunkd.log Error sending data to OpsGenie for search=Demo Alert: <urlopen error [Errno 97] Address family not supported by protocol> I am using Splunk Enterprise 6.2.5 with OpsGenie App for Splunk Thank you ... View more