This search sourcetype=named [search sourcetype="aws" varOutcome=Blocked|rex field=varDNS_Name "(?.*)."|table varShortName|dedup varShortName] Ends up creating a search like this sourcetype=named (varShortName=badsite1 OR varShortName=badsite2 OR varShortName=badsite1..) So if in your sourcetype=named logs you dont have an extracted field called varShortName it will not find any matching events. You can rename the field in your subsearch to match the field as it is named in sourcetype=named If you dont have a field extraction in sourcetype=named you can do something like this (returning only the first 100 values found) sourcetype=named [search sourcetype="aws" varOutcome=Blocked|rex field=varDNS_Name "(?.*)."|stats count by varShortName | fields varShortName | return 100 $varShortName] This will create a search like below where you are not looking for a key value pair and rather just the value... sourcetype=named (badsite1 OR badsite2 OR badsite3..) ... View more

If all events from this source have eventStartTime you can setup a props.conf setting for that source/sourcetype that tells splunk what timestamp to use when assigning the _time value. Based on the event you provided , and assuming that your events are not multi-lined, you could add this to your indexers props.conf. [source::/opt/log/yourLog] TIME_FORMAT=%Y-%m-%d %H:%M:%S.%3N TIME_PREFIX=eventStartTime= SHOULD_LINEMERGE = false ... View more

Setting up a macro is fine if you dont need to do the decoding every time you search. You can use the macro as needed. If you wanted this decoding to happen automatically every time someone searches that sourcetype you can add this to your props.conf on your search head. You should be able to apply the setting with out restartng by loading the debug/refresh endpoint on your search head your-splunk-server.net:8000/en-US/debug/refresh [theSourceType] EVAL-user_agent_string_decoded = urldecode(user_agent_string_encoded) http://docs.splunk.com/Documentation/Splunk/6.0.6/Knowledge/definecalcfields ... View more