Exceeding your license is the result of indexing too much data. It's unrelated to searching except for being blocked from doing searches until the violation is resolved. Windows logs are very verbose so it's very easy to exceed a small license just by indexing Windows events. Review what you are indexing and reduce it to only the minimum. Then contact Splunk for a key to unlock your ability to search. ... View more

Like this: | multisearch [ |makeresults | eval _time = " Search Time", message = " Search Message" ] [ YOUR ORIGINAL SEARCH HERE ] If you need it to be tokenized, then like this: | multisearch [ |makeresults | eval _time = " " . $time_token$, message = " " . $message_token$ ] [ YOUR ORIGINAL SEARCH HERE ] ... View more