Hi @mmodestino_splunk Thank you for replying. I now understand class is an identifier that we define ourselves, and may or may not use it anywhere else. For this problem, I do not see that I will need this combined class anywhere else. I will try to further illustrate the problem to chase the root cause. I am using Splunk of version 7.2.1 Inputs.conf [default] host = hostname _SYSLOG_ROUTING = devicename queueSize = 20GB persistentQueueSize = 30GB I am trying to catch logs coming in from port 1234. Since the logs are coming in alright, I am assuming that the configuration in Inputs.conf is all good. Or should I use port somewhere in there? The logs coming in are multiline and my primary purpose is to stitch the logs by replacing new line characters with "|". However, after failing to do so with multiple configurations, first I am determined to replace alphabets. The above configuration is all that I have configured for solaris:ldap in /opt/splunk/etc/system/local. I checked using the btool and there are other fields and values which are used from /opt/splunk/etc/system/default. The log sample I have given above is a complete line from a multiline log. It is not the first line of the log though. The complete log looks something like this: time: 20180702100600 dn: uid=xx11111,ou=xxxxxx,ou=xxxxxx,dc=xx,dc=xxxx,dc=xxxx,dc=xxxx,dc=xxx,dc=xx changetype: modify replace: pwdFailureTime - replace: pwdAccountLockedTime ... View more