This is INDEED the exact issue.  Editing via source and then simply closing/saving fixes the issue of the token adding spaces between each character which is then fed into any subsequent searches utilizing the token, which of course makes it fail.  Big thanks to "richardAtOmni" ... View more

Unfortunately, we never did find a solution to this. ... View more

Hi Collect is the command how you could create summary indexes. https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/Collect It has some restrictions e.g.with sourcetypes. Basically you could mask _raw and fields on your queries, BUT there is a way(s) to get the original data on screen if you know what you are doing. So only way to really mask it is reindexing it. r. Ismo ... View more

Thanks! Appreciate the response. Our team is in the process of verifying that this will work for us. I'll update once I hear back. ... View more

We recreated it with a different transform name and also changed some other stuff, and it showed up. Not sure what fixed it. Thanks for your help! ... View more

You need to use addinfo command like this your base search | addinfo | eval runtime_latest=info_max_time-_time | fields - info_* https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Addinfo ... View more

Your suggestion helped me. Thank you. 🙂 ... View more