Correct .. rex would be good for this but of course the issue is that the fields can change order from time to time so rex is no good .. nor is doing this in a transforms etc. I have already reached out to the vendor and said to them and stated .. " somehow you have broken splunks parser with your wacky log format " 😉 Lucky the vendor is in early stages of the product development so there is hope they will update at the log format .. it has many many issues other than the quotes around the values. ... View more

Yep the indexer is getting blocked .. and like SOS was saying most are syslog soruces and syslog is being sent to a file ... So I am not seeing IO issues on the box and one would think that if the indexer is being blocked it due to IO issue .. what would cause an indexer to be blocked ... volume ? yes if that is the case then the volume we are running is rather low for the hardware we have in place ... View more

Excellent! I'm glad to hear it. ... View more

This search shows the problem. | stats count | eval ips="2001:54FF:0000:ffff:ffff:ffff:ffff:ffff,2002:54FF:0000:ffff:ffff:ffff:ffff:ffff,2003:54FF:0000:ffff:ffff:ffff:ffff:ffff" | rex field=ips "(?P[^,]+)" max_match=0 | mvexpand ip | table ip | search ip=2001:54FF::/48 Splunk currently does not support ipv6 CIDR searching. BUT, because you are searching for a /48, these both work: | stats count | eval ips="2001:54FF:0000:ffff:ffff:ffff:ffff:ffff,2002:54FF:0000:ffff:ffff:ffff:ffff:ffff,2003:54FF:0000:ffff:ffff:ffff:ffff:ffff" | rex field=ips "(?P[^,]+)" max_match=0 | mvexpand ip | table ip | search ip=2001:54FF:* | stats count | eval ips="2001:54ff:0000:ffff:ffff:ffff:ffff:ffff,2002:54FF:0000:ffff:ffff:ffff:ffff:ffff,2003:54FF:0000:ffff:ffff:ffff:ffff:ffff" | rex field=ips "(?P[^,]+)" max_match=0 | mvexpand ip | table ip | search ip=2001:54FF:* As you can see, the capitalization does not matter. ... View more