Log Format Detector
Analyses the first event, classifies common SIEM log formats, and extracts likely field names.
Timestamp Detector
Detects standalone timestamp values using the expanded datetime format list.
MAX_TIMESTAMP_LOOKAHEAD = TIME_FORMAT = TIME_PREFIX =
Username Detector
Detects account identifiers such as UPN, email, SID, ARN, SAML NameID URNs, down-level logon names, and cloud principals.
IP Address Detector
Classifies an IPv4/IPv6 address or CIDR range, including private, loopback, link-local, and multicast ranges.
Line Break Detector
Detects event boundaries and suggests conservative Splunk event-breaking settings.
SHOULD_LINEMERGE = LINE_BREAKER =
Splunk TIME_FORMAT Reverse Lookup
Paste a Splunk datetime format string to identify the likely datetime standard, matching reference rows, expected example value, and parsing notes.
Epoch → Date/Time
Converts a Unix epoch value (seconds, milliseconds, microseconds, or nanoseconds) to UTC.
Date/Time → Epoch
Converts an ISO 8601 or similar date/time value to Unix epoch seconds, milliseconds, microseconds, and nanoseconds.
Ambiguous Date Disambiguator
For a slash/dot/dash-delimited date such as 03/04/2026, shows both the US (MM/DD) and EU/ISO (DD/MM) interpretations side by side.
Raw Event Timestamp Findings
Timestamp-like values detected inside the raw event.
Raw Event Username Findings
User-like values detected inside the raw event.
Raw Event IP Address Findings
IPv4/IPv6-like values detected inside the raw event.
Extracted Fields
Candidate fields and likely SIEM field categories from the raw sample.
Raw Event Line Break Findings
Event boundary analysis from the raw event sample.
Field Extraction & Sourcetype Suggestion
Suggested props.conf/transforms.conf extraction settings and a candidate sourcetype name for the raw sample.
Raw Event Encoding Check
Flags byte order marks, mixed line endings, control characters, and invisible characters that commonly break regex-based parsing.
Batch Consistency Check
Paste multiple raw events, one per line, to compare log format, extracted fields, timestamp format, and timezone context across the batch.
Regex Tester
Test an extraction regex against a sample string and inspect matches, capture groups, and named groups.
props.conf Validator
Paste an existing props.conf stanza and a sample event to check whether TIME_FORMAT, LINE_BREAKER, EXTRACT, KV_MODE, and other settings actually work against it.
props.conf Diff
Paste two versions of a stanza (for example, before and after a vendor changed their log format) to see exactly which settings were added, removed, or changed.
SPL Search Generator
Generates starter searches to confirm a new sourcetype is ingesting correctly, once props.conf is deployed.
Ingestion Config Generator
Generates an inputs.conf monitor stanza and a ready-to-send HTTP Event Collector (HEC) payload for the current raw event sample.
Lookup CSV Generator
Paste the distinct raw values seen for a field to generate a lookup.csv skeleton plus the matching transforms.conf/props.conf lines for value normalisation.
Eventgen Config Builder
Builds a Splunk Eventgen (eventgen.conf) stanza from the current raw event sample: one token per field, with a replacement type inferred from the timestamp/IP/username detectors, plus a live preview of generated events.
CIM Data Model Compliance
Checks the current raw event's extracted fields against the core fields of a common Splunk CIM data model. Core fields shown are commonly documented CIM requirements, not a substitute for the official Common Information Model Add-on.
Index Volume / License Estimator
Rough sizing estimate from average event size and volume. Splunk license usage is based on daily indexed (raw) bytes; on-disk storage is typically about half of raw volume, before retention and compression policy specifics.
Timestamp reference formats (0)
| Format | Example | Splunk TIME_FORMAT | Description | Validation notes |
|---|
Username reference formats (0)
| Precedence | Format | Category | Example | Template | Regex | Notes |
|---|