A-ha! What you are asking is to create a new field based on an existing field - when both fields are extracted at search time! AFAIK, this is not possible in props.conf or transforms.conf - but you can do it with the rex command, as Rob illustrates above. ... View more

Unfortunately, I realised that because we're on Splunk Free I can't schedule reports, so I've had to change them all to inline queries. Has the old "Saved Search" functionality been removed completely in favour of Reports? It was useful to be able to save common queries that I didn't necessarily want as a report, and access them from the menu drop down. ... View more

Are you referring to Chrome bug ID 6666? ... View more