If you know stanza name you should add also it.  Currently there is also splunk app called Admin's little helper, which you could use to run btool from MC or splunk cloud. I strongly recommended to install and use it in any distributed environments! https://splunkbase.splunk.com/app/6368 ... View more

Can you give any sanitized sample data? It's enough that fields are extracted, but not need to index those in ingesting phase? ... View more

https://splunkonbigdata.com/difference-between-streamstats-and-eventstats-command-in-splunk/ ... View more

You inherited someone else's mistake, but that doesn't mean you have to live with it.  IMO, you'll be doing yourself and your successor a favor by re-configuring the syslog server. If that's not possible then please describe how you've tried changing the sourcetype. ... View more