Try this: | rex field=_raw "(?:()(?P\w+)" I tested this at regex101.com and it seemed to do the trick. ... View more

What version of RHEL are you using? If you are using 7 or higher then you can just use the firewalld service and firewall-cmd to enable it. NOTE: Make sure that all your host firewall rules aren't already using iptables. if not already, enable firewalld # systemctl start firewalld Then start firewalld # systemctl start firewalld Just add the ports/services that you want to allow in: # firewall-cmd --add-service=snmp --perm (note: the --perm option makes it permanent after reloading) Now just reload the firewall rules and you should be good to go. # firewall-cmd --reload To doublecheck that it was added, just run: # firewall-cmd --list-services You should now see "snmp" as one of the services. ... View more

Another version that could work is: (?:arrived in state : )(?P\w+) ... View more

Said7, are you asking how to use a lookup table and incorporate it into a search of the Firewall traffic that you have being sent to your Splunk instance? Thanks! Glenn ... View more

I installed and tried this on my laptop. Open up a command prompt, and if you go to where Splunk is installed (on mine it was c:\Program Files\Splunk) then go into the "bin" subdirectory you should be able to stop/start/restart from there. When you do the restart it should pop a line up that says: " the Splunk web interface is at http://hostname:xxxx" The xxxx should be the port to use. Default is usually 8000 but on this instance, another process was using it (msirest.exe) and it had redirected to port 8001. ... View more

Are you both using the same make/model/version web browser? ... View more