Hi  , I have my log entries line below: 2023-08-22T10:48:01.340641-07:00 ARC1 (PID:63766948): Archived Log entry 176651 added for T-1.S-31459 ID 0xffffffffadc86430 host = alert1.corp source = /oracle/diag/rdbms/testprd/TESTPRD1/trace/alert_TESTPRD1.log sourcetype =alert-logs-oracle I want to filter the db name from this data which is "testprd" (4th field of Source) and hostname . Can someone please help me how to use delimiter to filter the db name from source?? ... View more

Hi All, I am new to splunk. While starting splunk for the 1st time , it is starting with "build" user even though $SPLUNK_HOME has root ownership.     ps -ef| grep splunk build 736222 1 0 06:42 ? 00:00:06 splunkd -p 8089 restart build 736226 736222 0 06:42 ? 00:00:00 [splunkd pid=736222] splunkd -p 8089 restart [process-runner]     I want to run it with root user....  How to fix this issue?? ... View more