Thanks for this reminder @HeinzWaescher. I'm working on a search/report, in which I already use replace with a wildcard to remove some redundant / superfluous text, but I hadn't yet used it like this. This is just what I needed to improve my timechart! ... View more

splunk>etc splunk>group splunk>meet splunk>local 514 (the syslog port) I don't know about splunk>local, reminds me of a union. haha! ... View more