Ever wonder if an address in your event can be connected via telnet? This could be one of your own addresses in your data center where running a telnet server is supposed to be prohibited. This is a Splunk command called telnetstatus that returns in real-time a status to see if a telnet server is running on the address in question. It takes as input a telnet_address field, which you can create by using | rename as telnet_status> and it returns a telnetstatus field. Possible return values per address are LoginFound, LoginNotFound, and None (Connection not made). Read the README.txt for installation.