Did you reload your data? Will only apply to new data. ... View more

I am going to assume you mean exactly what you said (which seems very strange to me). Do it like this in props.conf : [source::/nyx/nogscore/log/nogscore-*] SEDCMD-add_extra_newline_at_end_of_line_after_transactionid = s/(transactionid=.*$)/\1\n/g Note: After making changes to props.conf and deploying to Indexers (or Heavy Forwarders), restart all Splunk Enterprise instances to enable the configuration changes. This applies ONLY TO EVENTS THAT ARE INDEXED POST-RESTART. http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Anonymizedatausingconfigurationfiles ... View more

NEW FEATURE ALERT! As of Splunk 6.6, you can now do this from the Search Head GUI with the new Reassign Knowledge Objects feature: https://docs.splunk.com/Documentation/SplunkCloud/6.6.0/ReleaseNotes/NewSplunkCloudFeatures https://www.splunk.com/blog/2017/05/02/what-s-new-in-splunk-enterprise-6-6-and-splunk-cloud.html You can also do this from the REST API: https://wiki.splunk.com/Community:How_to_change_owner_of_savedsearches_using_REST_API ... View more