Two more things: Make sure you've restarted the forwarder You may need to wait for the log files to rotate to see a new header before the auto sourcetype works. ... View more

hey @jennjoe1 According to my experience,If your search is not heavy time/process consuming then I think it is better not to touch .conf files . but you want to do that then you should make changes in props.conf and transforms.conf in a local directory of jira i.e. jira/local/ copy the file from default and make changes in local Use normal method to extract fileds refer below link: https://answers.splunk.com/answers/5960/extract-a-field-from-event-source-filename.html https://answers.splunk.com/answers/574532/splunk-add-on-for-jira-setup.html Let me know if this helps! ... View more

Perfect 🙂 ... View more