Added the config for the new metadata field in the inputs.conf file and created a fields.conf file to set the field as indexed=true. Still the field is not showing up on SH. This is done for the cloud envi inputs.conf [monitor://D:\Splunk\abc\*.csv] disabled = false index = index_abc sourcetype = src_abc _meta = id::123   fields.conf [id] INDEXED=true ... View more

Hi, My single event length is too long so I want to extract and ingest the specific part from it. The part is in the middle of the event, so I tried extracting it using BREAK_ONLY_BEFORE and BREAK_ONLY_AFTER. Also used the LINE_BREAKER function but it is not working as expected. How can we define start and end of the log in the props.conf file? Is there any alternative to achieve this? Log sample: ... View more