works fine for me.. only added the following two commands for restarting the forwarder service: net stop SplunkForwarder net start SplunkForwarder ... View more

Hi, this one is working for both examples... But not the cleanest I think: ^.*?(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9]).*?".*?".*?(?<http_user_agent>-|".*?")\s(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9]?[0-9]) Danny ... View more

Hi Fabio, did you ever solve this problem.. I am running into a very similar issue... Kind regards, Danny ... View more