hi sieutruc sounds more like a routing problem, if you bind splunk to IP 178.17.0.80 you must have a network route to reach it from inside 192.168.194.0. are you able to do the following: 'ping searchhead' from inside 192.168.194.0, it resolves to the correct IP and you get an answer? are you able to open the splunk web page on http://178.17.0.80:<yourport>; from inside 192.168.194.0? update: why don't you unset the SPLUNK_BINDIP option so it binds to '*' ? SPLUNK_BINDIP=<ip address> * If unset, Splunk makes no specific request operating system when binding to ports/opening a listening socket. This means it effectively binds to '*' or an unspecified bind. The exact result of this is contolled by operating system behavior and configuration. cheers, MuS ... View more

hi abhayneilam please use the search before asking questions, it took me not even 20 sec to find the answer for your message..... The solutions are : identify and improve the regexes/field extractions ( best to do ) or change the warning threshold for key values extraction ( this way you are only fighting the smoke but not the fire ) edit $SPLUNK_HOME/etc/system/local/limits.conf, and change max_extractor_time value see http://docs.splunk.com/Documentation/Splunk/5.0/Admin/Limitsconf [kv] max_extractor_time = # Maximum amount of CPU time, in milliseconds, that a key-value pair extractor will be allowed to take before warning. If the extractor exceeds this execution time on any event a warning will be issued Defaults to 1000 avg_extractor_time = # Maximum amount of CPU time, in milliseconds, that the average (over search results) execution time of a key-value pair extractor will be allowed to take before warning. Once the average becomes larger than this amount of time a warning will be issued Defaults to 500 cheers, MuS ... View more