Thanks! Setting the time format did the trick. I did not change line merge to false because there are also many multi-line entries in these logs. ... View more

Thanks for the info. I will increase the disk space on the indexer volumes and try to tune them a bit further. I am mostly working with the main index (defaultdb) but will switch to dedicated index if necessary. Looking forward to 4.2 for some improvements in this area, but I can certainly make do with what is available at the moment. Cheers! ... View more

Thanks for the answer - using the related questions helped a lot. Also key piece of info was that SplunkLightForwarders do not apply transforms. The transforms get applied on the indexer. ... View more

Method 3 works perfect for me. ... View more