I've been trying to use the field extractor to get some useful data from my Sophos Anti-virus scan log. Unfortunately, it doesn't seem to work. I also can't figure out how I would break the event up using transforms.conf. The log contains the following summary when I search it in Splunk (it has it's own soucetype [SAV-too_small]). 20140604 042046 Scan 'Daily Scan 5am' completed. 20140604 042046 Summary of results for scan 'Daily Scan 5am': Items scanned: 198971 Errors: 0 Items quarantined: 0 Items dealt with: 0 What I want is to get some kind of table or chart where it splits up "errors" and "items" as separate fields. Any help would be much appreciated Thanks, thommck ... View more