Hi saito0910, try something like this: host=mailhost1 | rex field=client "(?<myIP>(\d+\.){3}\d+)
]$" | top limit=100 myIP this will get the IP form the client field and returns it as new field myIP hope this helps ... cheers, MuS ... View more

Hi wyldkao, check this http://docs.splunk.com/Documentation/Splunk/latest/Admin/MoreaboutSplunkFree there you can find information about the difference of free vs enterprise licens. the docs only mention TCP/HTTP forward is not available...syslog is UDP by default. I haven't tested it my self so I cannot be 100% sure on this.... cheers, MuS ... View more

Hi dwithers, take this run everywhere example and adapt it to your needs: index=_internal | head 1 | eval AD_time="129878945338632316" | eval myTime=AD_time/1000000000 | eval myNiceTime=strftime(myTime, "%F %H:%M:%S.%3Q") | table myNiceTime the first line is only to setup the AD like time field, the second eval will 'convert' it into epoch time and the last eval will create a nice human readable time stamp out of it. cheers, MuS ... View more

Hi adamsimpsondevops, Splunk ships with it's own openssl package and does not rely on the OS install of openssl. You can verify the Splunk openssl version by using the following command: $SPLUNK_HOME/bin/splunk cmd openssl version -a which returns something like this: OpenSSL 1.0.1e-fips 11 Feb 2013 built on: Tue Oct 29 22:05:26 PDT 2013 platform: linux-x86_64 options: bn(64,64) rc4(16x,int) des(idx,cisc,16,int) blowfish(idx) compiler: gcc -static-libgcc -L/opt/splunk/lib/static-libstdc -fPIC -DOPENSSL_PIC -DZLIB -DOPENSSL_THREADS -D_REENTRANT -DDSO_DLFCN -DHAVE_DLFCN_H -static-libgcc -Wa,--noexecstack -Wa,--noexecstack -m64 -DL_ENDIAN -DTERMIO -O3 -Wall -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -I/usr/local/ssl/fips-2.0/include -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DMD5_ASM -DAES_ASM -DVPAES_ASM -DBSAES_ASM -DWHIRLPOOL_ASM -DGHASH_ASM OPENSSLDIR: "/opt/splunk/openssl" As you can see I did not update my development box yet 😉 Back to your question: did you relink the openssl libraries on the forwarder OS so the UF will use the OS openssl or is it still using Splunk's integrated openssl? You can verify it by comparing the outputs of the command above and a openssl version -a on the cli of your OS. cheers, MuS ... View more

Hi C_Sparn, try something like this: index=_internal sourcetype="splunkd" OR sourcetype="splunk_web_access" | streamstats count by status, idx, sourcetype | stats values(idx) AS idx, values(status) AS status, values(sourcetype) AS sourcetype | mvexpand status | eval Status = if(match(idx,status), "MATCH", "NO MATCH") | table status, idx, Status | where Status="NO MATCH" Update: this is a run everywhere example of the final search used to get the expected result. streamstats hint came from a originally hint to use stats made by @somesoni2 🙂 hope this helps to get you started ... cheers, MuS ... View more