Hi @FrancoiseMathy  have you tried the below link https://docs.cyberark.com/Product-Doc/OnlineHelp/Idaptive/Latest/en/Content/Applications/AppsWeb/Splunk.htm?TocPath=Administrator%7CIntegrate%20applications%7CAdd%20applications%20for%20SSO%7C_____209 ... View more

Hi this has fixed also 8.1.8 as said here https://docs.splunk.com/Documentation/Splunk/8.1.9/ReleaseNotes/MeetSplunk#What.27s_New_in_8.1.8 r. Ismo ... View more

Right, that sounds like something different from what I have been dealing with. ... View more

Hello, Yes I haved tried what you suggested : In GUI, I put "index=trailsyslog host = | rex field=_raw "^(?P\w+)\s+(?P\w+)\s+(?P\w+)\s+(?P\w+\s+\w+\s+\d+\s+\d+:\d+:\d+\s+\d+)\s+(?P[^ ]+)\s+(?P\d+)\s+(?P\d+)\s+(?P\w+)\s+(?P.*)$" => this is ok. The events are parsed and different fields (trail_aix_status, trail_aix; time, ...) are present in the GUI. Then, In transforms, I put [aix_common_fields] REGEX = ^(?P\w+)\s+(?P\w+)\s+(?P\w+)\s+(?P\w+\s+\w+\s+\d+\s+\d+:\d+:\d+\s+\d+)\s+(?P[^ ]+)\s+(?P\d+)\s+(?P\d+)\s+(?P\w+)\s+(?P.*)$ In props, I put [trailsyslog-aix] REPORT-aix_common_fields = aix_common_fields . FYI, trailsyslog-aix is my sourcetype => I did a "splunk reload deploy-server" => I did the search "index=trailsyslog host = => nothing is parsed. The fields are not present. ... View more