@tiagofbmm, it really helped. Forgot to update. Thanks For your response! ... View more

It helped. Thanks! ... View more

... | rex "Subject : Plan Status - (?<eventID>\d+)\s(?<STATUS>\w+)" will work if you have additional stuff after that last line. ... View more

Yes, you create a .../local/times.conf that has this content: [all_time] disabled = 1 ... View more

We published an app this week that includes functionality to backup and restore your KV Store collections. Check it out: https://splunkbase.splunk.com/app/3536/#/details ... View more

It helped. Thanks. ... View more

Hi, Another option you could do, assuming your data is more of a 'one off' that continually updating, is just fix the format in Excel or Google Sheets. So something like: =TEXT(cell_ref, "000000") Which gives you: I find sometimes that it's easier to fix-up the data first, before Indexing it into Splunk. It's not always possible, depending on how your data is flowing in, but if you can, then tweak it first. The 3rd column was just to check how the Padded string would be interpreted (or as an easier to read column in the data). The formula for this is: =TIME(LEFT(cell_ref,2),MID(cell_ref,3,2),RIGHT(cell_ref,2)) ... View more