https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Add-on-for-Blue-Coat-ProxySG-What-is-the-regex-for-the/m-p/204026#M21575 <P>I believe the configuration should be available <CODE>$SPLUNK_HOME/etc/apps/Splunk_TA_bluecoat-proxysg</CODE> directory. Check both default and local directories inside this one.</P> <P>Reference: <A href="http://docs.splunk.com/Documentation/AddOns/latest/BlueCoatProxySG/Configureinputs">http://docs.splunk.com/Documentation/AddOns/latest/BlueCoatProxySG/Configureinputs</A></P> Mon, 15 Feb 2016 22:33:00 GMT somesoni2 2016-02-15T22:33:00Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Add-on-for-Blue-Coat-ProxySG-What-is-the-regex-for-the/m-p/204025#M21574 <P>Hello,</P> <P>Which is the regex for the host field extraction (not cs_host, but the proxy IP address) used by the bluecoat:proxysg:access:syslog source type?</P> <P>I found the one used for syslog source type in etc/system/default/transforms.props, but I need the specific one for bluecoat:proxysg:access:syslog source type.</P> <P>Thank you very much.</P> Mon, 15 Feb 2016 22:03:35 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Add-on-for-Blue-Coat-ProxySG-What-is-the-regex-for-the/m-p/204025#M21574 noybin 2016-02-15T22:03:35Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Add-on-for-Blue-Coat-ProxySG-What-is-the-regex-for-the/m-p/204026#M21575 <P>I believe the configuration should be available <CODE>$SPLUNK_HOME/etc/apps/Splunk_TA_bluecoat-proxysg</CODE> directory. Check both default and local directories inside this one.</P> <P>Reference: <A href="http://docs.splunk.com/Documentation/AddOns/latest/BlueCoatProxySG/Configureinputs">http://docs.splunk.com/Documentation/AddOns/latest/BlueCoatProxySG/Configureinputs</A></P> Mon, 15 Feb 2016 22:33:00 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Splunk-Add-on-for-Blue-Coat-ProxySG-What-is-the-regex-for-the/m-p/204026#M21575 somesoni2 2016-02-15T22:33:00Z