This seems to work in GUI. | makeresults | eval data="D,2,,200,00,8842,,USA,,1989,,2,320301120086,,,,,19899717024,,,320335100002,,,,,:,,,0,0,0,S,00000000,0,0.0,19899717024,104129,,,0,,,,," | rex mode=sed field=data "s/,,/,Null,/g" | rex mode=sed field=data "s/,,/,Null,/g" | rex mode=sed field=data "s/^,/Null,/g" | rex mode=sed field=data "s/,$/,Null/g" | table data I don't know exact reason why this is needed twice | rex mode=sed field=data "s/,,/,Null,/g"  Somehow it related to handling always two continuous characters and this is reason why it needs to run twice.  These two lines is needed to manage 1st and last pairs (,Null and Null,) correctly. | rex mode=sed field=data "s/^,/Null,/g" | rex mode=sed field=data "s/,$/,Null/g" I think that you could add a new transforms.conf for index time changes based on above?  ... View more

It's very strange, now i can use "line" field, but tag field is false: ... View more

Nothing like that is built into Splunk.  Consider writing a script that reads the files and adds the owner as a field. ... View more

I find my problem : I must add "protocol: https" on yaml file global: splunk: hec: protocol: https ... View more

Hello, Search this: index="_internal" REST_ta ... View more

Hi, Sorry for my error when I use "New Answer" Ans thank you for your help ! Your request is OK !!!! ... View more