Note: this patch to the FlashChart was posted as a part of Sideview Utils 1.3.1 ... View more

Scratch that. Posted the new version of Utils now, so go pull it down. It should fix this issue in all cases and do no harm. ... View more

Hi spock_yh you can use Process Explorer to see what is holding the lock on the file. Besides Apache it could be a running anti virus? regards ... View more

Thanks for the quick response. I installed the MAXMIND app and the Google Maps app, not sure if that installs the API as well. I haven't changed any of the default settings though - it's still set to use the python pygeoip API. Do you happen to know what these crash logs should look like? I'm seeing only the standard set of splunk logs there. Any way to debug what's gone wrong? ... View more

Understood. There is a more complex (but not as complex as yours) example at http://splunk-base.splunk.com/answers/31207/eval-limitations-on-si-index-with-sistats-count-by-field1-field2-etc ... View more

Hi Ayn The forwarders are universal forwarders (4.2). Regarding the superfluous '+' characters, the regex was basically copied from the default regex for "access-extractions" in the default props.conf. The double '+' means that the regex shouldn't backtrack after matching the spaces. Anyway, I find it hard to believe that the problem is the regex because pcregextest does claim it is a match. ... View more

Can you please provide the props.conf/transforms.conf stanzas that are responsible for performing the extractions and field aliasing? ... View more