I cant seem to find a efficient way to do this.  I have text box where a user first and last name is entered and depending on the search the token will be used but the text box is "first last" and I  need to transform it to  be either:   first.last OR first-last.   Please help as everything I have tried does not work.  ... View more

Setup an app folder on my search head (clustered with indexers and HECS)  "TA-Whatever"  from the app builder. Dropped a  py script in the default folder inside TA-whatever that gens a json file that gets dropped in the parent app TA-whatever folder.  When going to the add data, file and directory menu, I wen thru the server file system drop downs and selected the  json file and on the 2nd page where you select the sourcetype it sees the  json data.  After I select my index, source type and all that, finish, restart Splunk, and search the index,  I see nothing, no data is there.   I have rebuilt the app several times as the Splunk user,  as root.  chmod everything to 777. rebuild source types and index's. did props conf, treid with no entry in props.  added inputs conf to the local app folder, tried with no input.conf in the ta-whatever local folder,  also added a monitor to the global inputs.conf in etc/sys/local and still no dice.   here is my input.conf that i tried in global and the local app directory: [monitor://tmp/felt.json] disabled = 0 index = googlepyscript sourcetype = googlepy   also tried:   [monitor:///tmp/felt.json] disabled = 0 index = googlepyscript sourcetype = googlepy     No matter what I do the index is not getting data. I have tried it with the build in _json sourcetype and created my own and no data goes to the index after I finish the wizard.   Any input is welcomed at this point as I have been going at it for several days. Thanks!  ... View more

I am trying to match results to ONLY the names in a list I have using a lookup.  I cant figure out for the life of me what I am doing wrong, been trying every single variated on lookup and inputlookup  I can think of or find online.  Anyone have any idea what I am doing wrong? index=epp "Device Control" AND ("USB Storage Device" OR "Internal CD or DVD RW" OR "Internal Floppy Drive" OR "Zip Drive") AND NOT ("file read" OR "Connected" OR "unblocked" OR "Disconnected") | rex field=_raw "epp\.tusimple\.ai\s\-\s(?<LogSource>.*)\s\-\s" | rex field=_raw "\[Event\sName\]\s(?<EventAction>.*)\s\|\s\[Client\sComputer" | rex field=_raw "\[Client\sComputer\]\s(?<Hostname>.*)\s\|\s\[IP\sAddress" | rex field=_raw "\[IP\sAddress\]\s(?<IPAddress>.*)\s\|\s\[MAC\sAddress" | rex field=_raw "\[MAC\sAddress\]\s(?<MACAddress>.*)\s\|\s\[Serial\sNumber" | rex field=_raw "\[Serial\sNumber\](?<SerialNumber>.*)\|\s\[Client\sUser" | rex field=_raw "\[Client\sUser\](?<UserName>.*)\|\s\[Device\sType" | rex field=_raw "\[Device\sType\](?<DeviceType>.*)\|\s\[Device\]" | rex field=_raw "\|\s\[Device\](?<DeviceDescription>.*)\|\s\[Device\sVID\]" | rex field=_raw "\|\s\[Device\sSerial\](?<DeviceSerial>.*)\|\s\[EPP\sClient\sVersion\]" | rex field=_raw "\[File\s\Name\](?<FileName>.*)\|\s\[File\sHash\]" | rex field=_raw "\|\s\[File\sType\](?<FileType>.*)\|\s\[File\sSize\]" | rex field=_raw "\|\s\[File\sSize\](?<FileSize>.*)\|\s\[Justification\]" | rex field=_raw "\[Date\/Time\(Client\)\](?<EventTimeStamp>.*)\|\s\[Date\/Time\(Server\sUTC\)\]" [ | inputlookup R_Emp.csv | table EventTimeStamp LogSource EventAction UserName FileName FileType FileSize Hostname IPAddress MACAddress SerialNumber DeviceType DeviceDescription DeviceSerial ] ... View more