Hi everyone, I'm trying to create a simple list with all the devices found on the logs from globalprotect. The deal is, i'm using rex to match it with regular expressions.  I've already used  regex101.com to double check my search but, when I run it on splunk it fails. My search: index="ind_Aaaabbbb" log_subtype="globalprotect" globalprotectgateway-config-succ OR globalprotectgateway-logout-succ | rex field=_raw (?<device>\w\w\w\w\w\w\s\w\w\w\w:\s+(?:\w+\-\w+\-\w+|\w+)) | table _time, user, event_id, src_ip, device, dvc_name, dvc   The ideal expresions to capture: Device name: DDD-AAA-BBBBB Device name: DDDAAABBBBBBB   Error returned by Splunk: Error in 'SearchParser': Missing a search command before '\'. Error at position '198' of search query 'search index="index" log_subtype="globalpro...{snipped} {errorcontext = -\w+\-\w+|\w+)) | tab}'.   Example data: SYSTEM,globalprotect,0,2020/11/29,,globalprotectgateway-config-succ,Gateway-XXX-XX-XXX-N,0,0,general,informational,"GlobalProtect gateway client configuration generated. username.5, Private IP: 00.000.000.00, Client version: 5.1.1-12, Device name: DDD-AAA-BBBBB, Client OS version: Microsoft Windows 10 Pro , 64-bit, VPN type: Device Level VPN.",000...,0x0,0,0,0,0,,FW-PA-0000-AAA-CCC-TTTT SYSTEM,globalprotect,0,2020/11/29 ,,globalprotectgateway-config-succ,Gateway-XXX-XX-N,0,0,general,informational,"GlobalProtect gateway client configuration generated. username.5, Private IP: 00.000.000.000, Client version: 5.1.5-20, Device name: DDDAAABBBBBBB, Client OS version: Microsoft Windows 10 Pro , 64-bit, VPN type: Device Level VPN.",000...,0x0,0,0,0,0,,FW-PA-0000-AAA-CCC-TTTT   ... View more

Hi all, I'm having several issues after installing Splunk Forwarder on Any Win10 Device. (Win 10, Win Server 2012,2016). I'm using the following line: msiexec.exe /i splunkforwarder-7.3.4.msi FORWARD_SERVER="ADDserver:9991" WINEVENTLOG_SEC_ENABLE=0 WINEVENTLOG_SYS_ENABLE=0 SPLUNKPASSWORD=*Password* /L*v logfile.txt LAUNCHSPLUNK=1 SERVICESTARTTYPE=auto AGREETOLICENSE=yes /quiet The App gets installed and but no Logs packages are sent to the Server, The netstat command doesn't show me any: 9991 port connection. I've done the confirmation using "sc query SplunkForwarder" and the service is running, but again no log gets to be sent to my Splunk Console (Server). Help please, I'll provide any information you want to know. Or that I'm missing ... View more