http://docs.splunk.com/Documentation/Splunk/latest/Search/Aboutrealtimesearches With real-time searches and reports, you can search events before they are indexed and preview reports as the events stream in. ... View more

Updated: In this case, you'll want to use a macros and that will allow you to reference the macro and simplify the look of the search and if you ever need to use it in an adhoc fashion you'll just need to remember the macro. http://docs.splunk.com/Documentation/Splunk/5.0.4/Search/Usesearchmacros ... View more

You should try using stats with the values function: | stats values(src_port) values(dst_port) by policy_id ... View more

You could start with the Splunk Interactive Field Extractor (IFX) to parse out your fields for you. It will generate the appropriate regex for you. Sometimes it may need to be tweaked though. http://www.splunk.com/view/SP-CAAADUY http://docs.splunk.com/Documentation/Splunk/5.0.3/Knowledge/ExtractfieldsinteractivelywithIFX And yes you are correct that you'll use props.conf and transforms.conf to manually extract out fields. The IFX will write out data to those config files so you'll see the examples it creates. You should see those additions under $SPLUNK_HOME/etc/users. http://docs.splunk.com/Documentation/Splunk/5.0.3/Knowledge/Addfieldsatsearchtime There is also a way to extract fields on the fly in a search if it's something less common and you don't already have a field: http://docs.splunk.com/Documentation/Splunk/5.0.3/Search/Extractfieldswithsearchcommands ... View more