Ahhhhhh, alright. I inputted the local "ForwardedEvents" log (I'm using Event Collections to filter logs) and it just shows as "WinEventLog:ForwardedEvents" with no naming options. That sucks. Oh well! Thanks! ... View more

Ya, I didn't get that either... I ended up simply using REX: rex field=mount mode=sed "s/space/Splunk DB location/g" This takes the value "space" in the mount field (this is a df output) and replaces the word "space" with "Splunk DB location". ... View more