Try removing the '=' before your regex. The rex command syntax is: rex [field=<field>] (<regex-expression> [max_match=<int>] | mode=sed <sed-expression>) hence rex "[\d+\.]+\s(?P<source_ip>[\d+\.]+)\s\[\d+" ... View more

By links to reports do you mean alert emails? For alert emails you can set the hostname option in alert_actions.conf. alert_actions.conf.spec hostname = <string> * Sets the hostname used in the web link (url) sent in alerts. * This value accepts two forms. * hostname examples: splunkserver, splunkserver.example.com * protocol://hostname:port examples: http://splunkserver:8000, https://splunkserver.example.com:443 * When this value is a simple hostname, the protocol and port which are configured within splunk are used to construct the base of the url. * When this value begins with 'http://', it is used verbatim. NOTE: This means the correct port must be specified if it is not the default port for http or https. * This is useful in cases when the Splunk server is not aware of how to construct an externally referencable url, such as SSO environments, other proxies, or when the Splunk server hostname is not generally resolvable. * Defaults to current hostname provided by the operating system, or if that fails "localhost". * When set to empty, default behavior is used. HTH ... View more

We've been using splunk-auth-proxy, which we wrote internally, for the past few months and decided to open source it. Splunk SSO proxy for Google Apps: https://github.com/Shopify/splunk-auth-proxy Howto: http://nsmjunkie.blogspot.com/2011/08/google-apps-authentication-and-splunk.html Enjoy! ... View more