It appears no props.conf has been created, I'll talk more with the Admin. As for the Raw Data, It's Single Multi-line event: TimeStamp Component=F_Type_1,.....,Section_5=F_Type_1_Section_5_Valu...
See more...
It appears no props.conf has been created, I'll talk more with the Admin. As for the Raw Data, It's Single Multi-line event: TimeStamp Component=F_Type_1,.....,Section_5=F_Type_1_Section_5_Value Component=F_Type_2,.....,Section_5=F_Type_2_Section_5_Value Component=F_Type_3,.....,Section_5=F_Type_3_Section_5_Value But in the emulation is to ignore that TimeStamp: | makeresults
| eval data=split("Component=F_Type_1,.....,Section_5=F_Type_1_Section_5_Value
Component=F_Type_2,.....,Section_5=F_Type_2_Section_5_Value
Component=F_Type_3,.....,Section_5=F_Type_3_Section_5_Value", "
")
| mvexpand data
| rename data AS _raw
``` emulation assuming Splunk "forgets" to extract ```