The .spec file for chop and other processors is tad misleading, the correct syntax for this would be below. Note the comma separation for the tuples. multikv.conf [lsof_fixed] body.ignore = regex, "^(:?COMMAND|---\sOpen files:)" header.tokens = token_list, COMMAND, PID, TID, USER, FD, TYPE, DEVICE, SIZE_OFF, NODE, NAME ^(?.{9})\s(?.{4})\s(?.{4})\s(?.{7})\s(?.{5})\s(?.{8})\s(?.{18})\s(?.{9})\s(?.{10})\s(?.+) COMMAND, PID, TID, USER, FD, TYPE, DEVICE, SIZE_OFF, NODE, NAME body.tokens = chop, 0, 9, 10, 4, 15, 4, 20, 7, 28, 5, 34, 8, 43, 18, 62, 9, 72, 10, 83, 100 sample data: --- Open files: 'lsof' started on Fri Jul 12 20:57:38 UTC 2019 --- COMMAND PID TID USER FD TYPE DEVICE SIZE/OFF NODE NAME systemd 1 root cwd DIR 202,1 224 34 / systemd 1 root txt REG 202,1 1644360 4447583 /usr/lib/systemd/systemd systemd 1 root 22u unix 0xffff9e22222cdc00 0t0 32250 /run/systemd/journal/stdout auditd 1221 1532 root 7u unix 0xffff9e2222458800 0t0 13340 socket ... View more

To quickly rule out the effective time range being applied to the search, open job inspector; look at earliestTime and latestTime fields under job properties, these fields contain timezone offset information as part of the timestamp. ... View more