Fields have a name and values.  They can be renamed.  Values do not have names so they cannot be renamed. To change a value of a field, use the eval command to assign a new value. | eval Device_Interface="x_y_z" To change selected values of a field, use a condition within the eval. | eval Device_Interface = if(Device_Interface="foo", "bar", Device_Interface) Putting the field name in the else clause leaves the value unchanged if the condition is not met.   ... View more

To include the time component, we don't need to extract anything.  Just treat StartDateTime as a floating point number. | makeresults | eval StartDateTime="59025.5249306" | eval time=(StartTime-40587) * 86400 | eval humanTime=strftime(time, "%c") ... View more

Index-time extractions don't have an equivalent to the max_match option of the rex command.  Consider extracting all users together and then extracting them at search time. [get-users] REGEX = (\d:)(?<user>.+) FORMAT = users::$1   ... View more

Once multi-value fields are expanded, any relationship among them is lost.  They need to be combined into a new field before expansion. ... | eval new_field = mvzip("participants{}.object_value", "participants{}.role") | mvexpand new_field | eval new_field = split(new_field, ",") | eval object_value = mvindex(new_field, 0), role = mvindex(new_field, 1) The mvzip function combines two multi-value fields, separating them with a comma.  The split function later on breaks the field on the comma.  If you have more than two fields to combine, use nested mvzip functions. | eval new_field = mvzip(field1, mvzip(field2, mvzip(field3, field4)))   ... View more

Yes, Splunk merges the settings for inputs.conf from all enabled apps as well as system/default and system/local to arrive at what the complete list of inputs will be.  See the Admin Manual at https://docs.splunk.com/Documentation/Splunk/9.1.1/Admin/Wheretofindtheconfigurationfiles for a description of configuration file precedence. Note that etc/apps/test/inputs.conf will be ignored by Splunk because it is not in a local or default directory. ... View more