we are extracting fields with spaces in it using below transforms, Is there a way we can remove spaces in between fields from backend? There are 100's of fields with spaces. I tried with field alias amd it's hard to apply for each and every field.  Transforms: [sourcetype] SOURCE_KEY=_raw REGEX=(?<field>[a-zA-Z ]+):(?<value>.+) FORMAT=$1:$2 _raw: "Process Create: Utc Time: 2022-04-28 22:08:22.025 Process Guid: {XYZ-bd56-5903-0000-0010e9d95e00} Process Id: 6228 Image: chrome.exe Command Line:  test" output I am getting: "Process Id" =  6228 Is there a way we can change this to ProcessId=6228 or Process-Id=6228 ? From UI i tried this, Can someone help me with backend trick | makeresults | eval _raw="Process Create:true Utc Time: 2022-04-28 22:08:22.025 Process Guid: {XYZ-bd56-5903-0000-0010e9d95e00} Process Id: 6228 Image: chrome.exe Command Line: test" | rex field=_raw max_match=0 "(?<field>[a-zA-Z ]+):(?<value>.+)" | rex mode=sed field=field "s/ /_/g" | eval tmp=mvzip(field,value,"=") | rename tmp as _raw | kv | table * ... View more

We are using 3.4 version on Splunk_db_Connect app and I am trying to connect with snowflake db which requires JDBC driver. I am using latest veriosn of JDBC driver. Driver is loading correctly, when i created a connection i am seeing below error: Error: Database connection Splunk_Snowflake is invalid. No suitable driver found for jdbc❄️<host>:443/ I am using below connections: db_connection_types.conf [snowflake] serviceClass = com.splunk.dbx2.DefaultDBX2JDBC jdbcDriverClass = net.snowflake.client.jdbc.SnowflakeDriver jdbcUrlFormat = jdbc❄️snowflakecomputing.com:443/ port=443 displayName = Snowflake useConnectionPool = true Can someone help with issue Thanks in advance Splunkers! ... View more

I followed https://answers.splunk.com/answers/672614/how-to-configure-multiple-drivers-for-database-in.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev But it's not working for me. I installed latest version of db_connect(3.3) and JRE-11. I am trying to use both Oracle 11 and 12 drivers. I created local db_connection_types.conf and places both ORJDBC11,12 under splunk_app_db_connect>drivers but splunk is picking only higher version of it. Any ideas? ... View more

A single source have two different types of events and two different types of timestamps. raw event-1: Request Set Number: [1234567] - Scheduled Run Date: [2020-03-05 16:10:37.0] -source -values [{ all values} 5 more lines of data] raw-event-2: [Threat-123] 03/05 17:30:05,159, INFORMATION, [process name, process number] I tried with xml file and props.conf but is didn't fix the issue XML: <datetime> <!-- Request Set Number: [444888] - Scheduled Run Date: [2020-03-05 16:45:22.0] --> <define name="_datetimeformat1" extract="year, month, day, hour, minute, second , subsecond"> <text>\[(\d{4})-(\d{2})-(\d{2})\s(\d{2}):(\d{2}):(\d{2}).(\d{1,4})\]</text> </define> <!-- [Threat-11] 03/04 17:10:58,109, INFO --> <define name="_datetimeformat2" extract="month, day, hour, minute, second, subsecond"> <text>\s(\d{2})\/(\d{2})\s(\d{2}):(\d{2}):(\d{2}),(\d{3})</text> </define> <timePatterns> <use name="_datetimeformat1"/> <use name="_datetimeformat2"/> </timePatterns> <datePatterns> <use name="_datetimeformat1"/> <use name="_datetimeformat2"/> </datePatterns> </datetime> Props.conf: [my sourcetype] DATETIME_CONFIG = /etc/apps/SourcetypeName-datetime.xml SHOULD_LINEMERGE=false LINE_BREAKER = (Request\sSet\sNumber:\s\[\d+\]\s-\s\w+\W\w+\W\w+:\s\[|\[Threat-\d{1,5}\]\s) MAX_TIMESTAMP_LOOKAHEAD=60 MAX_DAYS_AGO = 45 I am still getting this error. 0500 WARN DateParserVerbose - Failed to parse timestamp in first MAX_TIMESTAMP_LOOKAHEAD (128) characters of event. Defaulting to timestamp of previous event (Thu Mar 5 16:30:37 2020). Context: source:: Can some one please help me on this issue.. Thanks in Advance. ... View more

I am trying to get count of four fields [ company_name companyID CustomerId Provider] by each hour index=IndexName | bin span=1h _time | stats count by company_name companyID CustomerId Provider _time | sort 0 _time | eval results= 'companyName'+" : "+'companyID'+" : "+'CustomerId'+" : "+'Provider' | eval time=strftime(_time,"%m-%d-%Y--%H-%M-%S") | table results time count | xyseries results time count | rex field=results "(?<companyName>.+):(?<companyID>.+):(?<CustomerId>.+):(?<Provider>.+)" | table company_name companyID CustomerId Provider * | addcoltotals labelfield=company_name label="Total_count" | fields - count results I am able to get results like i need, But i am pretty sure this search isn't the good way to do it. Expected results: company_name companyID CustomerId Provider 12:00 01:00 02:00 03:00 04:00 --- Apple 1234 vgs31982 pro-1 10 20 30 40 10 google 567 kjf733 pro-2 11 11 33 83 20 Total_count 21 31 63 123 30 can some help me on this. ... View more

We are trying to pull the firewall configurations into the spunk, but when we use the palo alto app/add-on we are getting only the rules which are actively using from the palo alto syslogs. We have a requirement to pull all the rules into the spunk and we can get them from the pan-os-xml-api (https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-panorama-api/pan-os-xml-api-request-types/get-active-configuration.html#), but trying trying to build a add-on to run the api and parse the XML data. I tried add-on builder, it is considering all my api o/p into a single event and i can't assign fields for the each xml tag. Any help ... View more