Hello everyone, I am trying to extract several “NEW” fields from a field and I am having trouble doing so. The field I am trying to extract from is a default field in an index but for some reason, the field name and its contents are not located in the "_raw" field. So, I am unable to use the built-in Splunk extractor to accomplish what I am trying to do. The contents of the sourcefield varies as seen below. sourcefield=/var/log/bash_history/localuser/DOMAIN\first.last.domain • I need to extract "localuser" as field1, "DOMAIN" as field 2, and "first.last.domain" as field3. sourcefield=/var/log/bash_history/DOMAIN\first.last.domain/DOMAIN\first.last.domain • I need to extract “DOMAIN” as field2 and “first.last.domain” as field3 Would it make sense to use the first example to extract all fields since both content paths share similar strings with the exception of “localuser”? That way, if the “localuser” field doesn’t exist it would just see it as NULL value? Any help will be greatly appreciated. ... View more

Ok, so I a trying my best to evaluate the differences between two search results. Search 1 gives me a list of "vm_name" index="1" sourcetype="1" source="1" | search state="running" | table vm_name Search 2 gives me a list of "hostname" index="2" source="2*" group=tcpin_connections | dedup hostname | table hostname Each search is crafted from two different indexes and sourcetypes. Both of these lists share common field values. For example, in search 1 vm_name can be named "MYPC" and on search 2 hostname is also "MYPC". Both are named MYPC and in reality, they are one and the same. However, I need to create a list that will essentially compare the values of both searches and if they match subtract them from one another and create the NEW list. The goal to remove MATCHED results from both searches to create a "DELTA's" list. I have tried the "join" command but when I do the results from the second search results are completely messed up. I tried created lookups and added them to one search but I have the same problem. The only thing I can think of is maybe the issue is the search itself may yield metadata somewhere that screws up the results. For example, on search 2 I need to add "dedup hostname" to the search to retrieve an accurate list. ... View more

PLEASE BE PATIENT I AM NEW TO THIS All, I am trying to use the results of a search (search 1) and create a new field in (search 2) to use as a “corresponding” field to identify user credentials. Search 1 field1 needs to correspond with search 2 fiieldX. fieldX in search 2 does not exist. The fields from both searches have different field names however fields 2 and 3 on search 1 has the same results/parameters as field 8 and 11 on search 2. I tried to use search 1 as a lookup and invoke it however I can’t seem to make that work due to field names not being the same on both searches. Any assistance and guidance for similar searches will be greatly appreciated! Thank you in advance. Search # 1 index=1 sourcetype=sourcetype1 | fields field1 field2 field3 | table field1 field2 field3 | dedup field2 Search # 2 index=2 sourcetype=souretype2 eventSource=eventSource eventName=Create OR eventName=Delete | fields field4 field5 field6 field7 field8 field9 field10 field11 field11 | dedup field4 | table field5 field6 field7 field8 field9 field10 field11 fieldX | rename field5 field5 as Event field6 as Time field7 Location field8 as Item_Name field9 as IP field10 as User field11 as Role fieldX as “???” ... View more