Hi alexl1, as stated in the docs http://docs.splunk.com/Documentation/Splunk/6.4.1/Knowledge/Managesearch-timefieldextractions still is still done by default: Splunk Enterprise applies the following "key cleaning" rules to all extracted fields, either by default or through a custom configuration: - All characters that are not in a-z, A-Z, and 0-9 ranges are replaced with an underscore (_). - All leading underscores and 0-9 characters are removed from extracted field names. To disable this behavior for a specific field extraction, you have to manually modify both props.conf and transforms.conf. Check with btool if any of your props.conf and transforms.conf in some app is disabling this function. Hope this helps ... cheers, MuS ... View more

Hi @alexl We do support Saved Searches in PHP, both retrieval and creation. See if this example helps. Cheers Glenn ... View more

do this: | history nothing before the pipe. You can do other searches after that to narrow it down or anything else splunk lets you do, as well. ... View more

if you mean for udp or tcp inputs, check the specifications http://docs.splunk.com/Documentation/Splunk/6.0/admin/Inputsconf connection_host = [ip|dns|none] * "ip" sets the host to the IP address of the system sending the data. * "dns" sets the host to the reverse DNS entry for IP address of the system sending the data. * "none" leaves the host as specified in inputs.conf, typically the splunk system hostname. * Defaults to "dns". ... View more

props.conf [my_sourcetype] REPORT-cleanupkeys = clean_my_keys transforms.conf [clean_my_keys] REGEX = ^([^=]*)=([^\n]*) FORMAT = $1::$2 CLEAN_KEYS = false ... View more

How I would tackle this is create a single column csv file in var/run/splunk called ip.csv. Give it a header name called IPADDRESS. This should be the fixed list of IP's Then I would do a search like below(rename ipfieldname with whatever the ip containing fieldname is called in your data and also rename the sourcetype value if you are even searching by a sourcetype) | inputcsv ip.csv | join type=left IPADDRESS [search sourcetype=somesourcetype | stats count(ipfieldname) AS IPCOUNT by ipfieldname | rename ipfieldname AS IPADDRESS] | search NOT IPCOUNT=* This will pull in the full list of fixed ips then run a subsearch which gets a count for each unique ip that it finds in your indexed data. it will when join that ip count to the csv list leaving any IP's that dont have a count to be left with a null value for the IPCOUNT field. Then the end of the search it looks for any IPCOUNT that dont have a value which means it was not seen in the data. There is probably a better way to do it but that's how off the top of my head i would do it. ... View more