Hi RNB, I cannot solve this problem, but i can help you to find a different way to achieve this. If I get it correct you want to match the -1- in #APF-1-ADD_TO_BLACKLIST_FAILED ? If this is correct, you can use field extraction like you tried and simply search for the values you're interested in. Try something like this: your base search to get the events here | rex "\:\s[\#\%](?<myField>.*?)\:" | search myField="*-1-*" This will create a new field called myField (name can be changed to what ever) containing APF-1-ADD_TO_BLACKLIST_FAILED and CCM_CALLMANAGER-CALLMANAGER-6-DeviceRegistered based on the provided examples. The last | search will only return all myField values which contains a -1- . After you got all working, setup automatic field extraction http://docs.splunk.com/Documentation/Splunk/6.2.1/Knowledge/Createandmaintainsearch-timefieldextractionsthroughconfigurationfiles and you no longer need to use rex . hope this helps to get you started ... cheers, MuS ... View more

Ok tried it myself with the file splunkforwarder-6.2.1-245427-x64-release.msi and the following command: msiexec.exe /i splunkforwarder-6.2.1-245427-x64-release.msi RECEIVING_INDEXER="foo:9997" WINEVENTLOG_SEC_ENABLE=1 WINEVENTLOG_SYS_ENABLE=1 AGREETOLICENSE=Yes /quiet this adds in $SPLUNK_HOME/etc/system/local/outputs.conf this entry: [tcpout] defaultGroup = default-autolb-group [tcpout:default-autolb-group] server = foo:9997 [tcpout-server://foo:9997] Maybe you need to download a fresh copy of the msi or you found a bug 😉 ... View more

It's okay not to post a comment, because this is correct. values does not truncate anything. Take this run everywhere example and see for yourself that the KBPS are mostly numbers around 0.[\d]{6} (that is a null point followed by 6 digits) index=_internal earliest=-7d@d latest=-1d@d | timechart span=1min values(kbps) AS KBPS cheers, MuS ... View more

you should be able just to provide the RECEIVING_INDEXER http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/RemotelydeployaWindowsdfwithastaticconfiguration during initial install as well ... but it is not honored in this case.... ... View more

Hi joshk2005, check out the deployment monitor app https://apps.splunk.com/app/1294/ which includes such searches like missing forwarder and other stuff which can be useful. Also check out the S.o.S app https://apps.splunk.com/app/748/ or if you're using Splunk 6.2 have a look at the http://docs.splunk.com/Documentation/Splunk/6.2.1/Admin/ConfiguretheMonitoringConsole cheers, MuS ... View more

Take a look at the docs http://docs.splunk.com/Documentation/Splunk/latest/Forwarding/DeployaWindowsdfviathecommandline you can find some examples in there. Feel free to accept this as answered - you will get some karma too 😉 ... View more

oh .. no, that's not correct. The option RECEIVING_INDEXER is only used on the CLI. Use this instead in your outputs.conf : [tcpout] defaultGroup = indexers [tcpout:indexers] server = simdc01:9997 autoLB = true use it this way, because you can add another indexer very easy and have load balancing between them. ... View more

using the flag RECEIVING_INDEXER='simdc01:9997' should have taken care of the outputs.conf ... did you check any of the outputs.conf on your forwarder if the config is correct? ... View more

Looks good to me. Can you connect from the forwarder to the indexer port 9997 any firewall between or routing problems? What does splunkd.log on the indexer and the forwarder report? ... View more

Hi eirika, that's possible check your splunkd.log for any DateParserVerbose messages to verify this. ... View more

This is not possible, since i don't know your environment nor your requirement. ... View more

although this is completely un-related to Splunk I provide an answer here 😉 rpm --queryformat "%{NAME} %{VERSION} %{INSTALLTIME:date}\n" -qa found here http://www.nbtnet.newboundary.com/support/docs/ppm/ppm/ppm_6_3/general_unix/ppm0362.htm after one single google search 🙂 ... View more

No that's wrong, you cannot specify an index in this case, because the DEST_KEY is queue. If you want to rewrite the index you must use this: DEST_KEY = _MetaData:Index FORMAT = AAA_Index And as hint: provide such information in the initial question 😉 makes it easier to answer 🙂 ... View more

How about the docs approach of nulling everything and explicitly keep only the AAA [good events like this: In props.conf: [AAA_GOOD] TRANSFORMS-set= setnull,setparsing In transforms.conf: [setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue [setparsing] REGEX = AAA\s\[good DEST_KEY = queue FORMAT = indexQueue I tend to setup things the way you can remember what they mean in two years from now. ... View more

those \s literal or regex spaces? ... View more

Hi abhayneilam, use this regex and it will only match AAA good : ^(?!.*AAA\sgood$).* cheers, MuS ... View more

Hi nishan_perera, Like @chanfoli wrote, this caused by the forwarding syslog server. You can fix it in Splunk by using a transformation. It should be done on the indexer(s). You will need two files, props.conf and transforms.conf, both of them in $SPLUNK_HOME/etc/system/local. I will assume that this is the only data that is coming from the syslog server, and that the syslog server is named syslogServer (for my example). props.conf [host::syslogServer] TRANSFORMS-t1=rename_host transforms.conf [rename_host] REGEX=Original Address\=(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}) DEST_KEY=MetaData:Host FORMAT=host::$1 This transformation will be applied to data from the host as it is indexed. Data already in the index will not be affected. cheers, MuS ... View more

Just to be precise: stats does not clear any field's value - but any field not provided with a stats command is not available afterwards in the search pipeline. Have a look at the eventstats command http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Eventstats which handle that. ... View more

According to the docs http://docs.splunk.com/Documentation/Splunk/6.2.1/Report/Acceleratereports#How_reports_qualify_for_report_acceleration only transforming commands qualify for report acceleration. Find a list of transforming commands here http://docs.splunk.com/Splexicon:Transformingcommand Feel free to accept this answer if it answered your question - you get some kudos as well 😉 ... View more

HeHe another epic one!! Maybe Yoda it was, post another question here he did 😉 ... View more