Close - needed the slash: eval http_user_agent = replace(http_user_agent,"\+"," ") ... View more

Please verify that the lea port is correct and check http://docs.splunk.com/Documentation/OPSEC-LEA/latest/Install/SetupSSLCAauthentication. If you're still having problems, please file a support ticket. ... View more