Hi, I'm trying to use the PREFIX directive in TSTATS (here : https://docs.splunk.com/Documentation/Splunk/9.1.0/SearchReference/Tstats#Use_PREFIX.28.29_to_aggregate_or_group_by_raw_tokens_in_indexed_data). In the docs, it says that it can work with data that does not contain major breakers such as spaces. My data contains spaces so I decided to try to change the major breakers this way: props.conf: [test_sourcetype] SEGMENTATION = test_segments segmenters.conf: [test_segments] MAJOR = \t MINOR = / : = @ . - $ # % \\ _ [ ] < > ( ) { } | ! ; , ' " * \n \r \s & ? + %21 %26 %2526 %3B %7C %20 %2B %3D -- %2520 %5D %5B %3A %0A %2C %28 %29 This way, only the tab (\t) is considered as a major breaker. I applied this, restarted and tried to ingest a line of log with the sourcetype "test_sourcetype". Unfortunately, it seems the segmenters.conf does not work because it keeps breaking with a space for example. I also tried to remove all MINOR and keep only MAJOR, but no luck: MAJOR = \t MINOR =   Have I made a mistake? Is it possible to do what I want? I think so because in this .conf presentation (https://conf.splunk.com/files/2020/slides/PLA1089C.pdf) they mention it briefly (page 37). Should I also use  SEGMENTATION-<segment selection> = <segmenter> in props.conf ? The docs says it is for SplunkWeb but I am considering all options... Thanks ... View more