Hello, I am running into a problem where I am attempting to use rex command similar to the Custom Chart Overlay in Simple XML examples. I know my search works in simple xml. earliest=-2hr latest=now | fields time_taken, cs_uri_stem, sc_status | rex field=sc_status \"(?<200>2\d\d)\" |rex field=sc_status \"(?<300>3\d\d)\" | rex field=sc_status \"(?<400>4\d\d)\" | rex field=sc_status \"(?<500>5\d\d)\" | rex field=cs_uri_stem \"(?<uri>/[\w\d]{0,13})\" | eval uri=lower(uri) |bucket _time span=2m | stats count(200) as 200, count(300) as 300, count(400) as 400, count(500) as 500, avg(time_taken) as AvgTime by _time uri but in the following it doesnt <div id="base-search" class="splunk-manager" data-require="splunkjs/mvc/searchmanager" data-options='{ "earliest_time": "-2@h", "latest_time": "now", "cache": "60", "search": ".... earliest=-2hr latest=now | fields time_taken, cs_uri_stem, sc_status | rex field=sc_status \"(?&lt ;200&gt ;2\d\d)\" | rex field=sc_status \"(?&lt ;300&gt ;3\d\d)\" | rex field=sc_status \"(?&lt ;400&gt ;4\d\d)\" | rex field=sc_status \"(?&lt ;500&gt ;5\d\d)\" | rex field=cs_uri_stem \"(?&lt ;uri&gt ;/[\w\d]{0,13})\" | eval uri=lower(uri) |bucket _time span=2m | stats count(200) as 200, count(300) as 300, count(400) as 400, count(500) as 500, avg(time_taken) as AvgTime by _time uri" }'> What gives? Thanks in advance ... View more

Does Splunk LDAP intergration support LDAP Extended Controls? In particular Matching rule OID 1.2.840.113556.1.4.1941 which is a special "extended match operator that walks the chain of ancestry in objects all the way to the root until it finds a match. I've tried implement this in my ldap strategy, but Splunk pukes; however, if I pass the same LDAP query listed in the AuthenticationManagerLDAP logging channel using Apache Directory Studio it works fine. Thanks in advanced, Additiona Links: Search Filter Syntax 3.1.1.3.4.1 LDAP Extended Control Active Directory Recursive Queries ... View more