I've got an instance of Apache that is processing client certificates for the remote user identity. I want to log the user activities so I created a custom log in the httpd.conf file: LogFormat "%h %l \"%{SSL_CLIENT_S_DN}x\" %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" \"%q\" %T" combinedssl Specifically, I replaced the normal access_combined %u with \"%{SSL_CLIENT_S_DN}x\" . Note that the certificate DN contains spaces so I included double quotes. To offset the changes in Splunk, I created a new index for just these logs, updated the local props.conf and transforms.conf files. I know the index isn't strictly required but I wanted to keep all of this separate so I could just delete/recreate the index as needed. In props.conf: [access_combined_ssl] REPORT-access = access-extractions-ssl In transforms.conf: [access-extractions-ssl] REGEX = ^[[nspaces:clientip]]\s++[[nspaces:ident]]\s++"[[qstring:user]]"\s++[[sbstring:req_time]]\s++[[access-request]]\s++[[nspaces:status]]\s++[[nspaces:bytes]](?:\s++"(?[[bc_domain:referer_]]?+[^"]*+)"(?:\s++[[qstring:useragent]](?:\s++[[qstring:cookie]])?+)?+)?[[all:other]] When I attempt to view all of the events in the index, I don't see any of the fields. In fact, it attempts to create a field for each of the sub-values (CN, OU, O, C) but nothing for "user". The remaining fields like timestamp are all out of place. I've tested a couple different things to keep it as a single user field but none of them appear to work. So I figured I would try to see if anyone else has tried this... ... View more

Does anyone know how webintelligence is generating this .csv? I would like to debug why I'm seeing the empty error but I don't know where to start. ... View more

Whenever I attempt to pipe results to the sendemail function, I get the following error: External search command 'sendemail' returned error code 1. Here's an example of the command I use: error OR failure OR severe | sendemail to=myemail sendresults=true server=mysmtpgateway from=myemail format=text I can confirm via direct telnet that my smtpgateway server is responding and accepting emails. Ideas? What does error code 1 mean in this context? Is this a python problem? Where can I look for more log details? (I've set "EmailSender" log level to DEBUG but I'm not sure how to find the output.) ... View more