On Splunk Enterprise 7.2.1 with Splunk Add-on for Microsoft Windows 5.0.1 I solved problem in the following way: Create file $SPLUNK_HOME/etc/apps/Splunk_TA_windows/local/transforms.conf. [Client_Address_as_src] SOURCE_KEY = Client_Address REGEX = ([\\]+)?([^f:\n][^-].*) FORMAT = src::"$2" [Client_Address_as_src_ip] SOURCE_KEY = Client_Address REGEX = ([\\]+)?([^f:\n][^-].*) FORMAT = src_ip::"$2" ... View more

What app you plan use for analyze syslog from trapx? If you will use https://splunkbase.splunk.com/app/4048/ then sourcetype=trapx:syslog, index=trapx. But you can change this in configuration files. ... View more