Thanks Tom, Your theory about the header is probably right. I ended up fixing the issue by setting crcSalt = In inputs.conf. It did result in my files being double indexed after resetting the Splunk server. That was a bit of a pain to resolve, but once I did the issue appears to have been fixed. Thanks for the tip! Best, Rob Rolnick ... View more

You understand correctly; you can do this, but only at search time. The dox are telling you that you cannot put everything into .conf files and have it all be automatic. That may be a bummer but it just means that the last parts of your stuff needs to be done at search time and saved off in the text of each saved search. What you CAN do is use an eventtype which contain the search-time search strings and then you start your search like this: eventtype=MyEventType You can also use a macro which is also evaluated at search-time and far less cumbersome and allows you to have a single place to update your stuff when you need to, instead of updating every saved search. ... View more