Hello, I'm trying to omit rows that contain matching fields, unless those fields are blank. Example syntax below: | where field1 != field2 UNLESS field1=" " Obviously the UNLESS won't work, but I've put it in there for arguments sake. An OR doesn't work in the above syntax, as if field1 is blank, field2 is blank too which would make the NOT EQUALS result in omitting the row. ... View more

Hello, I have 1 field in Splunk which contains 2 short email headers in plain-text, for example: **From**: Me (me@me.com) **Sent**: 28 September 2018 17:42 **To**: You (you@you.com) **Subject**: This is the first email **From**: Me (me@me.com) **Sent**: 28 September 2018 18:42 **To**: You-aswell (you-aswell@you.com) **Subject**: This is the second email There is more text after the 2 short email headers. I would like to use Rex to select the 2 Sent times, i.e: rex field=output "Sent: (?<sent_time_1>.*)" rex field=output "Sent: (?<sent_time_2>.*)" How do I select in the rex function which match to select? As an FYI, there may be text before the headers so selecting the line number wouldn't be an option. Thanks, ... View more

Hi there, I'm wondering if it's possible to format a Splunk query like so: IF results contains "this string" THEN use these formatting commands OR IF results contains "a different string" THEN use these formatting commands And if possible pull them all together in one table. If it makes it easier to explain, I will try and use network logs as an example e.g. say the logs are as follows: scrip=10.0.0.1 08/31/2018 11:23:34 PM (GMT) scrip=10.0.0.2 07-09-2018 23:33:57 index=network scrip=10.0.0.1 | convert time format OR index=network scrip=10.0.0.2 | different time format conversion | table bothtimeconversion Ideally the final table would look like this: scrip bothtimeconversion 10.0.0.1 09/07/2018 23:23:34 10.0.0.2 31/08/2018 23:33:57 I have already sorted the time conversion format, it's essentially how I would structure the different commands based on the different source IP. Thank you in advance ... View more

Hello, I have a field called in_time with example output = 8/31/2018 10:21:59 PM (GMT) I'd like this time (e.g. out_time) to be extracted and converted to read 31/08/2018 22:21:59 Can you help? Many Thanks, ... View more