In the above answer from jpvriel, < and > got transposed into (ampersand)lt; and (ampersand)gt;. For example, here's what the first one should look like when you enter them in Splunk: sourcetype=udp_stat | kv pairdelim="\n", kvdelim=": ", auto=f | rex "(?<p_rec>\w+)\spackets received" | delta p_rec as p_rec_delta | eval p_rec_delta=abs(p_rec_delta) | timechart span=5m sum(p_rec_delta) ... View more

mallem, I'd love if you could share the search you are using to alert on license breaches. ... View more