Hi Bellamar10, try this: | makeresults | eval foo="20182018--0505--2222 1111::3939::1818,,937937 [ [4747] ] ERRORERROR -- ErrorError MessageMessage:: OneOne oror moremore errorserrors occurredoccurred.. \xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xA \xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF Calling assembly Name/Source: Sms.Utilities, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null/mscorlib \xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF\xAF" | rex mode=sed field=foo "s/\\\xAF//g" The first 2 lines are used to create an event and the important command is the last line which will remove the characters \xAF from your search result. But remember the characters will still be in the _raw event 😉 Hope this helps ... cheers, MuS ... View more

Hi jiaqya, you are looking for the [batch://...] stanza in inputs.conf , here are the docs http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf#BATCH_.28.22Upload_a_file.22_in_Splunk_Web.29: [batch://<path>] * A one-time, destructive input of files in <path>. * For continuous, non-destructive inputs of files, use 'monitor' instead. # Additional settings: move_policy = sinkhole * IMPORTANT: This setting is required. You *must* include "move_policy = sinkhole" when you define batch inputs. * This setting causes the input to load the file destructively. Hope this helps ... cheers, MuS ... View more

Hi kahlerb, client_id suspiciously looks like an epoch timestamp and therefore Splunk thinks it is one. Configure a props.conf on the parsing Splunk instance for the sourcetype and use the TIME_PREFIX option like this : TIME_PREFIX="timestamp": " You might also need to adjust the MAX_TIMESTAMP_LOOKAHEAD to get that far into the event, and TIME_FORMAT to help Splunk to understand what format your time stamp has. See the docs http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf#Timestamp_extraction_configuration for more detail. cheers, MuS ... View more