Our dashboards were logging the time stamps as IP addresses. To resolve the issue we changed the props file extraction to EXTRACT-time to {8} from {6} then changed the other EXTRACT fields so they were higher than the previous EXTRACT {} field. New props. EXTRACT-date = (?i)logging_w3c:(?P[^ ]+) EXTRACT-time = (?i)^(?:[^ ]* ){8}(?P[^ ]+) EXTRACT-c_ip = (?i)^(?:[^ ]* ){9}(?P[^ ]+) EXTRACT-s_ip = (?i)^(?:[^ ]* ){10}(?P[^ ]+) EXTRACT-s_port = (?i)^(?:[^ ]* ){11}(?P[^ ]+) EXTRACT-cs_method = (?i)^(?:[^ ]* ){12}(?P[^ ]+) EXTRACT-cs_uri_stem = (?i)^(?:[^ ]* ){13}(?P[^ ]+) EXTRACT-cs_uri_query = (?i)^(?:[^ ]* ){14}(?P[^ ]+) EXTRACT-n_ip = (?i)^(?:[^ ]* ){15}(?P[^ ]+) EXTRACT-n_port = (?i)^(?:[^ ]* ){16}(?P[^ ]+) EXTRACT-sc_status = (?i)^(?:[^ ]* ){17}(?P[^ ]+) EXTRACT-sc_bytes = (?i)^(?:[^ ]* ){18}(?P[^ ]+) EXTRACT-cs_bytes = (?i)^(?:[^ ]* ){19}(?P[^ ]+) EXTRACT-final_time_taken = (?i)^(?:[^ ]* ){20}(?P[^ ]+) EXTRACT-cs_useragent = (?i)^(?:[^ ]* ){21}(?P[^ ]+) EXTRACT-cs_referer = (?i)^(?:[^ ]* ){22}(?P[^ ]+) ... View more

Hi VML, I had a similar issue when using Office 365 SMTP settings. Usually it is enough to specify smtp.office365.com however I got the same error as yourself. Try adding the port number at the end of the address within Email Settings. e.g. smtp.office365.com:587 (587 is default). For Office 365 this works with TLS enabled. Best wishes, Dan ... View more

Hi socespap, Did you get it configured, I am too looking to configure via SCP but facing some challenges. Please do let me know how did you fix it. ... View more

@socespap which version of Windows have you run power shell script on (to collect data) and which OS/version you have Splunk Insight for Infrastructure deployed on? ... View more

In my case, I left OPSEC LEA and used the Checkpoint Log Exporter to send via syslog. It comes very complete also in OPSEC. Thank you. James \m/ ... View more