Hi it's more or less same situation. You have those three options: Use lookup editor app Create own app which contains those definition and install it. In Victoria experience you can do it by your self On Classic edition you probably still need to create a support case or create cloud vetted private app on splunkbase from where you (probably) could install it by yourself? I said that the lookup editor app is probably the easiest way to do it unless your are familiar with your own apps and need this otherwise too. https://splunkbase.splunk.com/app/1724 r. Ismo ... View more