Hello, We are trying to cut the message field out of all of the Windows Security Logs coming from our domain controllers. I have tried looking though some of the other answer posts and I have tried using this article where you put [WinEventLog:Security] disabled = 0 suppress_text = 1 However I am not sure exactly what that references to remove data from the log. I know older answers said you could use a regex on the props.conf and transforms.conf file but I wasn't sure if that was still the best way for Splunk 6. All that said to really say could anyone help with removing the Message text from Windows Security Logs. Thanks in advance! ... View more