I know this is a while ago now, but maybe helpful to others...try using the "hidden" dimension `_timeseries`.  This is a JSON string that is an amalgamation of all of the dimensions for each datapoint. Take care, the results may be (very) high arity and splunkd doesn't (yet?) have very strong protections for itself (in terms of RAM used while searching) when using this code path, so it is (IMHO) easy to crush your indexer tier's memory and cause lots of thrashing.   ... View more

I'm not sure what is "pretrained" sourcetype. Is it provided by Splunk? So you create an add-on without any data input & field extraction s but only saved search? Firstly the best practice is from Splunk Add-on factory rather than AoB. AoB never creates any rules. That's the best practice how Splunk build add-ons in recent 4 years, and AoB helps your add-ons look like more "Splunk". Secondly AoB is used to validate new sourcetypes you created in your case. If you are not the owner of the sourcetypes, please just ignore this warning, since it's not an error. Thanks. ... View more