But does these mapping parse the data so that it populates in ES ... View more

Thank you very much , by adding this lines i can break this envents . ... View more

You can do this with a scripted input which you could also package into a modular input if you are going to reuse the configuration: http://docs.splunk.com/Documentation/Splunk/6.2.4/AdvancedDev/ScriptedInputsIntro You should also search apps.splunk.com in case somebody else has already written one; will this work? https://splunkbase.splunk.com/app/1639/ ... View more