Hi all,  I want to know how splunk extracts fields from TA_windows inputs when mode=multikv  The _raw event does not seem to have any sort of field indicator (as compared to events from TA_nix which has headers)  As an example:  Splunk_TA_windows/local/inputs.conf     [perfmon://Network-Bytes] disabled = false counters = Bytes Total/sec; Bytes Received/sec; Bytes Sent/sec; interval = 60 mode = multikv index = perfmon useEnglishOnly = true object = Network Interface sourcetype = PerfmonMk:Network     gives _raw events as seen indexed in Splunk:      vmxnet3_Ethernet_Adapter 19069.926362422757 11044.290764991998 8025.635597430761 vmxnet3_Ethernet_Adapter 26173.569591676503 15701.614528029395 10471.95506364711 vmxnet3_Ethernet_Adapter 28654.246470518276 17482.977608482255 11171.268862036022     From this output, splunk magically extracts fields like:      Bytes_Received/sec Bytes_Sent/sec Bytes_Total/sec instance category collection     I checked the TA_windows configs and ran btool, but could not trace configs other than some standard PerfmonMk:<object> stanzas in Splunk_TA_windows/default/props.conf which contain only FIELDALIAS settings What am I missing? How does splunk know which field is which?  How does it even get values for category & collection when those values are not even present in the _raw?    Further comparison, TA_nix add-on does this in a much more legible manner (which can be easily understood and played around with) like:  Name rxPackets_PS txPackets_PS rxKB_PS txKB_PS eth0 1024.00 1972.50 1415.04 674.94 ​     Additional:  I want to convert the PerfmonMk events to metrics, has anyone attempted that?      ... View more