I feed data to Splunk using the HTTP Event Collector, sample event: { "event":{ "event_id": "58512040", "event_name": "Access Granted", ... "event_local_time_with_offset":"2025-07-09T14:46:28+00:00", }, "sourcetype": "BBL_splunk_pacs" } I set up datasource type BBL_splunk_pacs (see screenshot below) When I search for the events, I get: I see 2 issues: _time is not parsed correctly from the event_local_time_with_offset. Most of the time, randomly (?), we get all event fields duplicated, and sometimes they are not duplicated. Any idea what I may be doing wrong? Thank you.
... View more