Hello,    I just faced the same situation. In my case I detected that the file libmqic_r.so was not present in all the directories needed (/usr/lib and /usr/lib64) /usr/lib/libmqic_r.so /usr/lib64/libmqic_r.so /opt/mqm/lib/compat/libmqic_r.so /opt/mqm/lib/libmqic_r.so /opt/mqm/lib64/compat/libmqic_r.so   I just copied the one in /opt/mqm/lib to the .usr/lib and /usr/lib64 and restarted Splunk and it works. Something that is important to mention is that all the files requiered must have read permissions by the user that is running Splunk.  I hope it helps!. ... View more

Hello Daniel,  I found that using the command replace you can create a calculated field called dest. | eval dest = replace(replace(dnsQuery,"\(\d+\)","."),"^\.|\.$","") On the first replace you eliminate all the number rounded by parenthesis, and on the other replace you eliminate the first and the last period. So on Cloud you only need to create a calculated field and put the function replace, just like this replace(replace(dnsQuery,"\(\d+\)","."),"^\.|\.$","") I hope it helps other Splunkers to solve this issue or other similar.  ... View more

Professional services recommend me to do the following: sourcetype="xtype" query | eval long_str=replace(_raw, "\n", "###") | rex field=long_str "):\s(? .+)" | makemv delim="###" Message | table _time Message The second part of the search replaces the new lines for a know pattern (on this case ###). Then you use REGEX to capture the field from the long_str Using makemv you break the lines when it found the pattern "###" Lastly you present the data into a table, this is the result. Query a ejecutar: SELECT prop_account, description FROM tracking.google_analytics_web_properties WHERE prop_type = 'qa' AND home = 'es_cl' AND portal = '*' ... View more

Thank you, that works to capture all data into the variable but it does not maintain the line breaking inside the Message Variable ... View more

I found this link that talk about the features that you lost when use a Free license. http://docs.splunk.com/Documentation/Splunk/4.3/Admin/TypesofSplunklicenses#Free_license ... View more