Hi marees123, how about something like this: *swt* "changed state to" */*/* | rex "(?i) Interface (?P[^,]+)" | rex "(?i)changed state to (?P.+)" | table host, AnInterface, UpDown, _time | sort +_time or *swt* "changed state to" */*/* | rex "(?i) Interface (?P[^,]+)" | rex "(?i)changed state to (?P.+)" | table host, AnInterface, UpDown, _time | reverse or *swt* "changed state to" */*/* | rex "(?i) Interface (?P[^,]+)" | rex "(?i)changed state to (?P.+)" | chart values(AnInterface) AS AnInterface values(UpDown) AS UpDown over _time by host hope this helps ... cheers, MuS ... View more

Hi diewin, this is the normal behavior if you send cooked data from a forwarder to an indexer over any TCP port. You should check / verfiy why your splunktcp input is not working correct. Check the splunkd.log on your indexer for any errors related to this port. Another thing to remember, did you search all indexes over all time as well? hope this helps ... cheers, MuS ... View more

Hi splunker12er, this is how I would do it: forward all Splunk instances internal logs to the two indexers, see docs http://docs.splunk.com/Documentation/Splunk/6.2.1/DistSearch/Forwardsearchheaddata setup / run your query on the search head, but not against the metrics.log (this only tracks the top ten usages per type http://docs.splunk.com/Documentation/Splunk/6.2.1/Troubleshooting/Aboutmetricslog) Use as well the License Usage view on the license Master to get an overview http[s]://splunk-url:splunkport/en-GB/manager/search/licenseusage#historyTab hope this helps ... cheers, MuS ... View more

Hi himynamesdave, try something like this as line breaker regex : From\s.+?@ based on the assumption I understood you correct and you want everything after the @ as new line 😉 cheers, MuS ... View more

Hi sbeamro, Either change the URI from en-US to en-GB or use the convert command to do this on selected fields http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Convert hope this helps ... cheers, MuS ... View more