Figured out not just an answer, but a solution since the one provided does not scale to large enterprises. The solution is not to make Splunk adapt, but instead change the way data is sent to it. The Blue Coat app and TA require sending data in the bcreportermain_v1 format--which is an ELFF format. Then the app and TA try to parse this space separated data using the complex regex seen above. Instead of doing that, you can instruct Blue Coat to send the data in a different format such as key value pair--which Splunk likes and natively parses. Have the Blue Coat admins define a custom log format with the following fields: Bluecoat|date=$(date)|time=$(time)|duration=$(time-taken)|src_ip=$(c-ip)|user=$(cs-username)|cs_auth_group=$(cs-auth-group)| x_exception_id=$(x-exception-id)|filter_result=$(sc-filter-result)|category=$(cs-categories)|http_referrer=$(cs(Referer))|status=$(sc-status)|action=$(s-action)|http_method=$(cs-method)|http_content_type=$(rs(Content-Type))|cs_uri_scheme=$(cs-uri-scheme)|dest=$(cs-host)| uri_port=$(cs-uri-port)|uri_path=$(cs-uri-path)|uri_query=$(cs-uri-query)|uri_extension=$(cs-uri-extension)|http_user_agent=$(cs(User-Agent))|dest_ip=$(s-ip)|bytes_in=$(sc-bytes)|bytes_out=$(cs-bytes)|x_virus_id=$(x-virus-id)|x_bluecoat_application_name=$(x-bluecoat-application-name)|x_bluecoat_application_operation=$(x-bluecoat-application-operation)|target_ip=$(cs-ip)|proxy_name=$(x-bluecoat-appliance-name)|proxy_ip=$(x-bluecoat-proxy-primary-address)|$(x-bluecoat-special-crlf) Since this data comes into Splunk as key=value pair now, Splunk parses it natively. Remove the TAs from the indexer and replace it with a simpler props.conf file of this: [bluecoat:proxysg:customclient] SHOULD_LINEMERGE = false This just turns off line merging which is on by default and makes the parsing even faster. Also remember to rename the props.conf and transforms.conf (ex: .bak files) included in the app if you have it installed on your search head--that contains the same complicated regex which will slow down data ingestion. By the way, by defining your own format, you can add other fields you care about--such as the target IP (cs-ip) which is not included in the default bcreportermain_v1 format for some reason. Hope this helps others than run into this situation. ... View more

First, ensure you have the following setup: 1) FireEye app only on the search head (https://splunkbase.splunk.com/app/1845/) 2) TA installed on the HF and indexers (not on the search head) (https://splunkbase.splunk.com/app/1904/) Second, make sure the sourcetype is either syslog or fe_cef_syslog. If the sourcetype is syslog, the props/transforms will change it to fe_cef_syslog. Third, make sure rsyslog is not adding any additional headers to the content. Transforms it looking for the following format for CEF syslog: REGEX=.fenotify.:\sCEF:\d|FireEye| If none of that solves the issue, send me a sample of your data via the Help -> Send Feedback menu in the app. Thanks. ... View more

Is there a reason you are running Splunk version 5.0.6? If you cannot upgrade to Splunk 6.x, then we recommend that you use the older FireEye Splunk app that works with version 5.x. I have posted links to both FireEye Splunk apps below. App for Splunk version 5.x: https://splunkbase.splunk.com/app/409/ App for Splunk version 6.x: https://splunkbase.splunk.com/app/1845/ Hope that helps. If not, feel free to email me directly through the Splunkbase app download page. ... View more

This was a pretty slick solution: https://answers.splunk.com/answers/84053/how-to-set-max-column-length.html. But it seemed to slow down presenting the results. Snippet: "Easiest was to make it a multivalued field. ... | rex field=longfield max_match=0 "(?<longfield>.{0,50})" that'll split longfield into lines of no more that 50 characters." ... View more

This is an awesome solution, but it seems to take a long time to "Finalize" the search results for a large number of returned values. Can we think of anything that is faster? Otherwise, it would be ideal if Splunk could just provide column width control without going to .css. ... View more

Would really appreciate an example one-liner. Thanks! ... View more

I am having the same issue. Permissions are global read which is fine. The workflow is not private. It will work just fine using Splunk search and reporting, however when I place a raw event table in the dashboard and attempt to activate the work flow via the Event Actions button, the workflow option is not there. ... View more

I am having the same issue with the token based refresh not working. ... View more

I think you may mean: cisco:esa:textmail Instead of what is written: cisco:esa:mailtext Unless this has changed in the past year. ... View more

Would love to see an officially supported solution that does not involve keeping duplicate copies of dashboards. Duplicate copies just increases required effort and overhead when you want to make even a simple change. Ideally, just use the default input values and run the report. Not sure why this is complicated. ... View more

Thank you for the solution. This is great information for any appliance in which you are stuck receiving junk data. Fortunately, it appears Blue Coat can be told to send data in a different format. See answer below. ... View more

Interesting regex.... because it is better than a complete miss which is what occurs right now. I wonder if it would be possible to turn the results into an array using props/transforms. I have been experimenting with an spl solution and found: rex field=_raw max_match=0 max_match Syntax: max_match= Description: Controls the number of times the regex is matched. If greater than 1, the resulting fields are multivalued fields. Default: 1, use 0 to mean unlimited. ... View more

I have the same issue. Will post back if I find anything. Environment is distributed with three indexers and a fair amount of traffic. Thanks. ... View more

The latest infoblox TA supports DHCP as a sourcetype: sourcetype=infoblox:dhcp eventtype=infoblox_dns eventtype=infoblox_session_start eventtype=infoblox_session_end Check out the documentation here: http://docs.splunk.com/Documentation/AddOns/latest/Infoblox/Sourcetypes TA is available here: https://splunkbase.splunk.com/app/2934/#/overview ... View more

Splunk recently developed a TA for infoblox. The TA is here: https://splunkbase.splunk.com/app/2934/#/overview (The TA includes some panels for DNS and one for DHCP.) Documentation is here: http://docs.splunk.com/Documentation/AddOns/latest/Infoblox/About ... View more

The latest infoblox TA supports DHCP as a sourcetype: sourcetype=infoblox:dhcp eventtype=infoblox_dns eventtype=infoblox_session_start eventtype=infoblox_session_end Check out the documentation here: http://docs.splunk.com/Documentation/AddOns/latest/Infoblox/Sourcetypes TA is available here: https://splunkbase.splunk.com/app/2934/#/overview ... View more

There appears to be an official TA from Splunk now: TA: https://splunkbase.splunk.com/app/2934/#/overview Documentation: http://docs.splunk.com/Documentation/AddOns/latest/Infoblox/About ... View more

The TA is here: https://splunkbase.splunk.com/app/2934/#/overview (The TA includes some panels for DNS and one for DHCP.) Documentation is here: http://docs.splunk.com/Documentation/AddOns/latest/Infoblox/About Enjoy! ... View more