@jip31 , use this link https://conf.splunk.com/files/2019/slides/FN1570.pdf   I keep this handy for troubleshooting the indexing or queue issue.  ... View more

|rex "(?im)\w+\=\"(?P<http_x_forwarded_for>.[^\,]+)" or else |rex "(?im)\w+\=\"(?P<http_x_forwarded_for>\d+\.\d+\.\d+\.\d+)" ... View more

Hi Chris,  Can u assist with the steps (troubleshooting efforts) you have taken to integrate the proofpoint cloud logs ... View more