@eyirik data sample you provided, seem to me similar for each MODEL. It's just that some fields are optional. If it is so and you know what those fields mean, you can just use one universal regex and create a field extraction via UI or configure it in props.conf : EXTRACT-models = ^(?<timestamp>.*?),(?<model>.*?),(?<fieldA>.*?)(?:,(?<fieldB>.*?))?(?:,(?<fieldC>.*?))?(?:,(?<fieldD>.*?))?(?:,(?<fieldE>.*?))?(?:,(?<fieldF>.*?))?(?:,(?<fieldG>.*?))?(?:,(?<fieldH>.*?))?(?:,(?<fieldI>.*?))?(?:,(?<fieldJ>.*?))?(?:,(?<fieldK>.*?))?(?:,(?<fieldL>.*?))?(?:,(?<extras>.*))?$ extras is there only for cases when there are some additional / unknown fields and those will be stored in the extras field. And basically if you need to extend the number of fields to be extracted, just copy the sequence (?:,(?<fieldL>.*?))? over and over and change the name of the field. ... View more

I don’t believe trellis is currently working on the mobile app. I don’t see any documentation specifically saying it’s a known issue in mobile version 2.4.4 (latest version), however, I don’t believe it is supported. I would submit an enhancement request through the Splunk Support Portal. ... View more

Assuming you're only wanting the elevation of ground level above or below sea level at a particular geographic location, the Google Maps Elevation API seems like it would fit your purposes: https://developers.google.com/maps/documentation/elevation/start Obviously, this isn't the elevation of whatever device is recording data, as a device in a tower is not at ground level, but it might be what you're looking for. Now, I don't know of a Splunk app that wraps this API in Splunkbase yet, but that doesn't mean you couldn't make one! What you'll need to do in Splunk is create an external lookup python script that would take the lat/long coordinates, pass these to the elevation API, and then return them to Splunk. There are a few examples of doing this in the docs, around Splunk answers, and the Internet: http://docs.splunk.com/Documentation/Splunk/6.5.3/Knowledge/Configureexternallookups https://answers.splunk.com/answers/145561/how-to-script-a-lookup-in-python.html https://answers.splunk.com/topics/scripted-lookups.html https://www.slideshare.net/Splunk/splunk-dynamic-lookup/18 (and following slides) ... View more

The timestamp inside splunk is displayed with the splunk user's time zone. ... View more

I would write a scripted input to read the data from the source and perform the necessary transforms and bit operations. It would then prepend a timestamp and deliver the results to Splunk. ... View more