Finally after a lot of testing I found a solution via transforms.conf   [timestamp-fix] INGEST_EVAL= _time=json_extract(_raw,"instant.epochSecond").".".json_extract(_raw,"instant.nanoOfSecond")   Furthermore, it turned out that regex is not allowed in TIME_FORMAT field in props.conf. ... View more

I found a solution myself in the meantime. In particular for step three and four: 3) export as json file 4.1) let the json-file run through my python-script (see below) ./script.py > /tmp/missingdata.txt 4.2) one-shot the outputs of this to the index ./splunk add oneshot /tmp/missingdata.txt -index foo -sourcetype logimport my python3 script: #!/usr/bin/python3 import json fp=open('./export.json', 'r') line = fp.readline() while line: parsedline=json.loads(line) print(parsedline["result"]["_raw"]) print("HOST = "+parsedline["result"]["host"]) print("SOURCE = "+parsedline["result"]["source"]) print("SOURCETYPE = "+parsedline["result"]["sourcetype"]) print("###") line=fp.readline() fp.close() props.conf: [logimport] LINE_BREAKER=(###\n) TRANSFORMS = importsource, importsourcetype, importhost, importraw transforms.conf: [importhost] REGEX =\nHOST = (.*) FORMAT= host::$1 DEST_KEY = MetaData:Host WRITE_META = true [importsource] REGEX=\nSOURCE = (.*) FORMAT= source::$1 DEST_KEY = MetaData:Source [importsourcetype] REGEX=\nSOURCETYPE = (.*) FORMAT= sourcetype::$1 DEST_KEY = MetaData:Sourcetype [importraw] REGEX=^(.*)\nHOST DEST_KEY = _raw FORMAT = $1 ... View more