That works! Thanks a lot! ... View more

Make sure the ENTIRE search is on a single line within the macros.conf file. Line breaks will kill this quite quickly. ... View more

Please update to the latest version, located here: http://apps.splunk.com/app/1059/, as this latest version addresses this issue. Thank you, Jeff. ... View more

All of the quoted fields have underscores, which are often created by splunk because it converts spaces to underscores. If you change your output to AS something without a space or underscore the quotes might go away. Excel will import the example given as csv, but some fields will have quotes. ... View more