Thanks. But Splunk doesn't pick it up. Here is what I have in props.conf and transforms.conf. props.conf: [source::/logs/dxserver/3*_query_*.log] REPORT-queryLog = dsaname transforms.conf: [dsaname] SOURCE_KEY = source REGEX = 3......(?P .+?)rly FORMAT = dsaname::$1 Example of the source field = "/logs/dxserver/3wtxq20corerly1_query_20140601.log". I expect the dsaname field equals to 'core' (without the qoute). Any syntax or format errors? Thanks. ... View more

Note that the forwardedindex.whitelist.2 entry described above is the default starting with version 5.0.2, I believe. ... View more

1- first extract the fields from each events. by example with the rex command, or any automatic field extraction. see http://docs.splunk.com/Documentation/Splunk/4.3.3/Knowledge/Addfieldsatsearchtime. example with rex: mysearch | rex "CPUCOUNT (? \d+)" 2- then create a stats that will display then per host ... | stats value(cpucount) by host 3- rotate the table if you want each event as a column ... | transpose ... View more