If you don't want to remove SA-cisco-asa, you may want to do a modification in 'SA-cisco-asa/default/transforms.conf' ; 1. create directory 'local' under 'SA-cisco-asa' 2. copy 'default/transforms.conf' to 'local/transforms.conf' 3. add following to 'local/transforms.conf'; [networkservice] filename = service-names-port-numbers.csv max_matches = 1 copy file 'Splunk_CiscoSecuritySuite/lookups/service-names-port-numbers.csv' to 'SA-cisco-asa/lookups/service-names-port-numbers.csv' restart splunk no errors so far... ... View more