After lots of reading and too many attempts.  Renaming the fields is the best option, IMO.  Example below is where src is the IP address.  This is undocumented. | rename * AS _* | rename _src AS src | scrub | rename _* AS * (It would be nice if scrub took a field listing as an option.  It appears you can do this through config files, but getting that done on splunkcloud would be $#%^py.  Please upvote the idea.) ... View more

I am facing similar issue these days with many Servers as Splunk forwarder was installed on Template Server . I was not able to find guid in server.conf however there is surely an instance.cfg . What do you all recommend . Should I try below command OR just remove the instance.cfg file .However those cloned serves are getting wrong host name as well so I need to remove two things . $SPLUNK_HOME/bin/splunk clone-prep-clear-config   ... View more