We are running the Blue Coat ProxySG App for Splunk app (https://splunkbase.splunk.com/app/2815) and associated TA downloaded from the BTO site.
When running on a distributed environment with multiple indexers, we receive the following message:
Field extractor name=custom_client_events is unusually slow (max single event time=1146ms)
The transforms.conf contains:
[custom_client_events]
REGEX = (?[^\s]+)\s+(?
↧