https://docs.splunk.com/Documentation/AddOns/released/F5BIGIP/Setup   I have two issues: 1. In the Splunk docs, the provided log format for DNS logging is prefixed with "<190>". I believe this number represents the facility(local7) and severity(info). The DNS request/response events do not have log_levels associated with and I assume this is the reason. I don't know if the syslog servers or Splunk are doing something wrong. 2. The "answer" field in the DNS response events is a quoted string that looks like this" "test1.f5lab.dhs.gov*. 5 IN A someIpAddress". But when displayed in Splunk, something has replaced the tabs with some kind of ASCll string. Splunk shows the answer field value pair as such: "test1.f5lab.dhs.gov. #0155#011IN#011A#someIpAddress. I'm unsure is this is happening on the syslog server or Splunk side. ... View more

Good Day Splunkers! I've been banging me my trying to capture all email address as recipients. Is this even possible?    "status":"delivered":"recipient":"some.name@mail.com":"subject":"Thank you!":"   "status":"delivered":"recipient":"some.middle.name@mail.com":"subject":"Thank you!":"   "status":"delivered":"recipient":"\"Name Some \"<some.name@mail.com>":"subject":"Thank you!":"   "status":"delivered":"recipient":"some.name@mail.com,  another.name@mail.com,  more.names@mail.com subject":"Thank you!":"   "recipient":"\"different.name@mail.com\" <different.name@mail.com>, \"same.name@mail.com\"<same.name@mail.com>":"subject":"Thank you!":"   ... View more

I have logs from switches being ingested, but the data doesn't conform to any standard data model. Is this possible or   ... View more