Oct 30 06:55:08 Server1 request-default Cert x.x.x.x - John bank_user Viewer_PIP_PIP_env vu01 Appl Test [30/Oct/2023:06:54:51.849 -0400] "GET /web/appWeb/external/index.do HTTP/1.1" 200 431 7 9 8080937 x.x.x.x /junctions 25750 - "OU=00000000+CN=John bank_user Viewer_PIP_PIP_env vu01 Appl Test,OU=st,O=Bank,C=us" bfe9a8e8-7712-11ee-ab2e-0050568906b9 "x509: TLSV12: 30" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36" I have above in the log.  I have field extraction (regular expressions) to extract user and in this case "John bank_user Viewer_PIP_PIP_env vu01 Appl Test".  The alert did find this user but reported the user name as "john".  There are some other users, who have space in the name shows up in alert fine. How do I fix the extraction so entire user name shows up in the alert? ... View more

I created an extracted field called remote_user.  My search for certain dates do bring the field value properly. However the same search for some other dates do not bring the proper values. I checked the events and the extracted field is malformed on the dates having issues. The remote_user field value will be like "CompanyName John_doe".  The days when search is working the remote_user shows "CompanyName John_doe".  The dates when the search is not working the field shows  value as "CompanyName". How can same extracted field works differently on different dates? Any suggestions? ... View more

I have 400+ error codes and want to search them. The issue is my search for multiple codes for 5 months freezes (there may be a limit on search?). My question is how can I iterate over error codes, and search one error code at a time, and have Splunk save it before working on the next error code? ... View more

We are monitoring the user activities for a day. The query is as follows. remote_user=a OR remote_user=b OR remote_user=c index=my_index earliest=@d+450m latest=@d+18h |timechart count as "User Name" by remote_user. The issue is if a user does not have activity than report is not showing that. We want the report to include the user with 0 activity. Is there a way to force that into search? ... View more

I already have an alert setup if a user does not have activity. The alert is set with number of results = 0. However, we have situation when splunk forwarder did not send data because the underlying logs stopped populating. This created a false negative that user is not logging. How do I incorporate the scenario that if no logs are coming than no alert. The current search as follows. index=appl_index user="xyz" I would check index=appl_index | stats count | if (count=0,do not alert, else go with my current query) Thanks in advance. ... View more

I have created a csv file with dates of federal holidays. holiday_date 01/01/19 01/21/19 I am trying to run my search like below. index=appxindex |eval today_date=strftime(_time,"%m/%d/%y") | search NOT [|inputlookup exclude_holidays.csv holiday_date as today_date ] The above is not working. All I want to do is if today_date = holiday_date (in csv file), I do not want to search. Any ideas? ... View more