The original problem I am trying to fix is that I am not able to tag single events since they dont have a small enough field to use for the tags(only unique field was over 1024 chars). The solution for this was to create on the sourcetype we care about a field that would generate sha256 values making a unique field. What i have added in the local diretory of the TA for the sourcetype: transforms.conf [add_event_hash] INGEST_EVAL = event_hash=sha256(_raw) FORMAT = event_hash::$1 WRITE_META = true props.conf [thor] TRANSFORM-event_hash = add_event_hash and fields.conf [event_hash] INDEXED = true The result after restarting Splunk and re-importing the data is that the field is successfully created with the value we want, yet the field value is not searchable. The search generates 0 results when searching for event_hash=<hash> but only generates the correct result when using event_hash=*<hash>* any assistance would be much appreciated   ... View more

I have some data that their event field is sometimes... lengthy (not always) so when I try to tag the events of interest, I am not allowed (presented with the error 'Parameter "name" must be less than 1024 characters.'). Is there a workaround or a better way of tagging those events? ... View more