I should have included, that Splunk does seem to recognise there are values in they "keys", but doesn't extract them as individual fields...  So, I guess what I am looking for here, is for Splunk to pull out the dataList{}.name, and the corresponding dataList{}.value as a field/key-pair. Thanks  ... View more

Well, yes.. hmm, just what do the numbers (12,23,28) mean? How do you mean that the regex pulls in too much data? Do you not get a field called 'client', containing values like CLIENTA, CLIENTB etc? Or are you getting everything from CLIENTx to the end of the line? As I understand your post above, you want a count of all log lines (i.e. all requests regardless of the resource being requested), grouped on the .. 'instance' for lack of a better word. Is this 'instance' just the CLIENTx value or the CLIENTx value in combination with the preceeding number? /k ... View more

Download splunk (free) to another machine - index the data, move the buckets to the production. ... View more

I already solved the problem adding the below lines on the deploymentclient.conf file of the *nix forwarders: [deployment-client] repositoryLocation = $SPLUNK_HOME/etc/apps serverRepositoryLocationPolicy = rejectAlways Thanks anyway, bye. ... View more