@dmuley - You need to install Splunk Universal forwarder onto the Kubernetes instance and monitor log files under the `/var/log` directory usually. But you can check the location of log files with the below command: (the command is deprecated BTW) kubectl --log-dir   How to install UF - https://docs.splunk.com/Documentation/Forwarder/9.0.4/Forwarder/Installanixuniversalforwarder How to monitor log files - https://docs.splunk.com/Documentation/Splunk/9.0.4/Data/Monitorfilesanddirectorieswithinputs.conf    I hope this helps!!! ... View more

The most obvious thing would be to use transaction to group the events by threadId. But that would mean "squishing" togethet the eventType and data values so you'd have to do some clever joining/separating fields. Feasible but not very pretty. You could do the same but firstly rename fields conditionally so that you end up with properly uniquely named fields per threadId. Then you could either do the transaction command or stats values (stats is usually a better approach) by threadId. You can also use xyseries to "unpack" the separate fields into a table. ... View more

Thanks for clarifying the question.  Try adding this rex command to your query. | rex mode=sed "s/\<InfoNox_Interface .+?\>//"   ... View more

Yes you are such a kind person. thanks a lot @ITWhisperer  ... View more

| rex "data=\"\<(?<data>[^\>]+)" ... View more