Hi @leon12, at first the term "data Model" in Splunk means a different thing that you mean: a data Model is a table containing data extracted from events and archived in a MongoDB table, probably you are meaning "dataset". Anyway, the parsing configurations are stored in props.conf and are fixed for that sourcetype. props.conf must be located on the Indexers or, if present, on Heavy Forwarders. Also the eval transformations can be inserted in the props.conf so you don't need to repeat them in eavery search. The association between an input folder and a sourcetype is done by you in the inputs.conf. ciao. Giuseppe ... View more

Hi @leon12, I suppose that the Datum is also the timestamp of the event. In this case, please try something like this: <your_search> | rex "(?ms).*Description:\s(?<Description>.*).*Node:\s+(?<Node>.*).*Severity:\s+(?<Severity>.*)" | table _time Description Node Severity That you can test at https://regex101.com/r/tCns4x/1 If Datum isn't also the timestamp, you have two ways: modify your props.conf to use Datum as timestamp (_time), insert datum in the regex I hint the first solution. Ciao. Giuseppe ... View more