Came back to answer my own question. Replay mode not needed. You should have a separate app where you are doing your configurations. For example, make a blank app in C:\Program Files\Splunk\etc\apps\mytesting The "local" directory is where props.conf and transforms.conf should go. I've tested this, and it works. Props.conf will have the name of the sourcetype as the stanza header/title. It will then have additional options and reference the configuration in transforms.conf. In transforms.conf, Regexes can be on one line, or separately in multiple lines under the same stanza. Below is an example: props.conf: [apache_access] KV_MODE = none REPORT-apache_extracts = ub_apache_extracts FIELDALIAS-apache = user AS userid clientip AS src_ip transforms.conf [ub_apache_extracts] REGEX = ^(?\d\d/..... blah blah blah When you do a search, make sure you are in your "mytesting" app, or whatever you named it. Copying stanzas from production may or may not work. Try the regexes in Splunk first before trying to make them work in transforms.conf. Do a little bit at a time. ... View more

Came back to answer my own question. The root of my issues was that I was not including milliseconds in my logs. The reason I left them out at first was because I was struggling to find a regex that worked in Eventgen. I would test it in Splunk but, Eventgent would not take it. Eventually, I found and an extraction that worked for me: # 10/07/2016 14:00:04.123456 token.0.token = \d{1,2}/\d{2}/\d{4}\s\d{1,2}:\d{2}:\d{2}.\d{6} token.0.replacementType = timestamp token.0.replacement = %m/%d/%Y %H:%M:%S.%f After I did this, it worked much better, and I no longer had to output to file. If you think about it, the time multiplier can't work very well if you have a large number of events in the same second. Here is a tip: to have uniform time regexes in eventgen.conf, concatenate the datetime in a uniform format with the _raw field in the source data that you export. Eventgen will get the first date that it reads in the event line according to your regex. This eliminates a lot of the troubleshooting when trying to catch the date field, especially with logs that have multiple date time formats. ... View more