We have a ticket index i.e index=incident the status of the ticket is Assigned but I need to write the same data back into the incident index with new status = Orphaned Also need to changed the _time index=incident Incident_Number="XXXXXX" ticketStatus=Assigned | rex mode=sed "s/Status=\"Assigned\"/Status=\"Orphaned\"/" | rex mode=sed "s/ticketStatus=\"Assigned\"/ticketStatus=\"Orphaned\"/" | collect index=incident ... View more

This is all that's in the log file <splunk>/var/log/splunk/splunkd.log    05-06-2022 12:35:57.137 +0200 WARN SearchResultsCSVSerializer [5148 MongoModificationsTrackerThread] - CSV file contains invalid field '', ignoring column. 05-06-2022 12:35:58.135 +0200 WARN SearchResultsCSVSerializer [5148 MongoModificationsTrackerThread] - CSV file contains invalid field '', ignoring column. 05-06-2022 12:35:59.137 +0200 WARN SearchResultsCSVSerializer [5148 MongoModificationsTrackerThread] - CSV file contains invalid field '', ignoring column. 05-06-2022 12:36:00.137 +0200 WARN SearchResultsCSVSerializer [5148 MongoModificationsTrackerThread] - CSV file contains invalid field '', ignoring column. ... View more

How did you know which .csv file to check  ? ... View more