Sadly it did not work, any IP i put in for field3 (whether in the whitelist or not) displayed in a table with value of "Yes" for InWhitelist  Also field4 that holds the hostname does not carry over to the table    ... View more

I found it in /apps/launcher/local/inputs.conf ! So i can delete the rest stanzas in here and should be good to go with the re-install right? to modify rest calls ... can i normally edit in the input.conf or is it best to just create new ones? thanks! ... View more

Try this: index=database_dump sourcetype="retinacs-database-view-asset" AssetName="*" | fields AssetName, index, OSName, DomainName, IPAddress, LastUpdateDate | eval AssetHostName=upper(AssetName) | dedup AssetHostName | search NOT [search sourcetype="symantec-db-clients" | eval AssetHostName=upper(COMPUTER_NAME) | dedup AssetHostName | fields AssetHostName, index ] | regex AssetHostName!="[0-9].*" | search NOT AssetHostName=*CLUSTER* NOT OSName=*Linux* NOT OSName=*Blue* NOT OSName=*Cent* NOT OSName=*ESX* NOT OSName=*iLO* NOT OSName=*Integrated* NOT OSName=FreeBSD* NOT OSName=*LaserJet* NOT OSName=*MAC* DomainName=DMC |stats count, values(IPAddress) as IPAddress, values(DomainName) as Domain, values(OSName) as OperatingSystem, values(LastUpdateDate) as LastUpdateDate, values(index) as Source by AssetName | search count=1 Source=database_dump | fields - count Source ... View more

Hi, Could you please post any update if you have got on this? Thanks in Advance ... View more

i have the same issue and the DHCP servers i have that are producing the logs with the missing comma are Windows Server 2000. my splunk build is version 4.3, build 115073. I also have 2 DHCP servers that are Windows Server 2003 and there logs are fine. How can i go and add the comma to the 2000 boxes? ... View more