Hi, I need a query that gives me the following: All servers in my domain that have not connected to Splunk. with someting like this: where domain="*" AND Type="*" AND dNSHostName="SEWI*" | rex field=distinguishedName "CN=(?<hostname>[^\,]+).+" Hope u can help me. Thank you in advice, Thomas
... View more