Hello @livehybrid , Thank you very much. I got the required result now. However, I see one issue here. When I try to clone this to Dashboard Studio, this particular color formatting didn't get converted . Can you suggest a way to make it work ? Regards, Siddarth ... View more

@inventsekar We have onboarded the data coming from csv files in inputs.conf as below and the data is loaded every day as new csv is created with date stamp. [monitor:<path>/file_*.csv] disabled = false sourcetype = <sourcetype> index=<index>   With this config, we are getting the data into splunk and each row in csv is loaded as separate event. Query:  index=<index> sourcetype=<sourcetype>.   All we need is to see the data similar to csv ie. we need to have a single line header and corresponding data for those columns (just how we see when we load the csv from Add inputs via Splunk GUI).    As of now, events are like as shown below and it repeats every day for new csv files   6/17/24 3:07:26.000 AM   col1,col2,col3,col4,col5,col6   host = <host> source =<source> sourcetype =<sourcetype>  6/17/24 3:07:26.000 AM   data1,data2,data3,data4,data5,data6 host = <host> source =<source> sourcetype =<sourcetype>    We need the output in below format when we run query: col1 col2 col3 col4 col5 col6 data1 data2 data3 data4 data5 data6   Regards, Sid ... View more

@inventsekar There are multiple csv files from which data gets loaded into Splunk. So, the _raw will have column headers and other rows for each file. All I need is to convert back into rows and columns format just like what we see in csv. "table" command will not serve the purpose for my scenario. ... View more

@bowesmana  I'm still not getting the expected result. The regex pattern should remove all leading zeros in each octet. however, in this case, it is just removing the leading zero in whichever octet it finds at first place.  For example: 1) 010.1.2.3 -> it removes zero in 1st octet - > 10.1.2.3 2) 10.001.2.3 -> it removes zero in 2nd octet -> 10.1.2.3 3) 010.001.2.3 -> it removes zero in 1st octet only -> 10.001.2.3 4) 10.001.002.3 -> it removes zero in 2nd octet only -> 10.1.002.3 5) 10.1.2.003 -> it removes zero in 2nd octet only -> 10.1.2.3   Regards, Sid   ... View more

@yuanliu - Its not working for this requirement. I see its returning entire output field value multiple times (equal to number of lines in the field.) ... View more