Hi, It works like a charm ! I didn't know that only one stanza per port number was currently supported, I expected it to take the most specific. I've followed the examples and I've done it like this: transforms.conf: [cisco_esa_parser] REGEX = :\d\d\s+(?:\d+\s+|(?:user|daemon|local.?).\w+\s+)[?(MachineName)[\w.-]]?\s FORMAT = sourcetype::cisco_esa DEST_KEY = MetaData:Sourcetype props.conf: [source::udp:514] TRANSFORMS-changesourcetype = cisco_esa_parser Thanks for your help, -- Xavier ... View more

Hi, No answer yet? Has anyone had this problem before? ... View more

Hi, Thanks for the information. I'll try to export it using the CLI commands until the 4.3 is released: splunk search '*' -maxout 0 splunk search '*' -maxout 0 | wc -l splunk search '*' -maxout 0 > exportfile.txt I'll try to find out how to define the time range with theses commands. ... View more