In our organization our apache log files are of type access_combined with the exception of the host field being replaced with the value(s) from the x-forwarded-for field because of the use of load balancers and other caching mechanisms. This creates a situation where the host field end up looking like: xx.xx.xx.xx or xx.xx.xx.xx, xx.xx.xx.xx or xx.xx.xx.xx, xx.xx.xx.xx, xx.xx.xx.xx etc I have seen log entries with as many as 5 host ip's in the x-forwarded-for field. Can someone explain the process required to have splunk correctly index the access logs given this variability in the log entries? ... View more