Hello Splunk Community, I am trying to add the following command to the props.conf file to make the following search permanent:   I am still very new to the Splunk world and therefore I have no experience with the props.conf file. I made a copy of the props.conf file in the folder /opt/splunk/etc/system/local and put the command in there (See below).   However, when starting Splunk now  the following message appears:   I suspect I phrased the command wrong or wrote it into the wrong section in props.conf. Also, it would be interesting to know if the part of the command that brings the events in table form can also be written into the props.conf file and if so into which section of the file? Many thanks and greetings ... View more