In the case of my customer, the data model json file was missing, and the datamodels.conf was set up with acceleration = 1. So every 5 minutes, Splunk would be complaining. Simply removing references to the missing data model is an easy fix. Or, recreate the data model from backup if one is available. I see in other cases this has to do with permission - check out this answers article ... View more

Found this here on Answers ... View more

For now, all the light I can shed is that I see athe exact same error (different data model though) with one of my Splunk customers. The "-0500" in the beginning of your line is your time zone, so not really a part of the message. I will post my findings if I figure out what is going on with this error message. ... View more

Hi, This boils down to understanding how SPL work. The search 192.168.(144 OR 244).1 work because you really do a free-text search. And this free-text search can be broken into three parts: 192.168. (144 OR 244) .1 . Which is just the same as writing "192.168." AND (144 OR 244) AND ".1" , or ".1" AND "192.168." AND (144 OR 244) If you check Job inspector, you will find good information on this. E.g. Splunk translate 192.168.(144 OR 244).1 into keywords *.1* *192.168.* 144 244 This approach will not work as expected when searching in specific fields. Again, this is because Splunk break up the search into multiple statements. srcIP=192.168.(144 OR 244).1 will be the same as writing srcIP="192.168." AND (144 OR 244) AND ".1" , where (144 OR 244) AND ".1" is a free-text search. Cheers! #Sven Emil ... View more

Hi ashnet16, As Kristian says, we need some real data and also exactly what you try to extract from that data. With that said, your original rex | rex field=file "(?\.(.{2,4}\s+?))" does not look right. If you want to convert your original regular expression \.(.{2,4}\s+?) to rex, I would expect it to look something like this: | rex field=file ".(?<fieldname>.{2,4}\s+?)" Cheers! #Sven Emil ... View more

I see the exact same behaviour, running 6.1.4 on Windows. Any news on this? ... View more