WE ARE HAVING TWO EVENTS THIS MONTH!
Why?  Because we are continuing our regular 2nd-Tuesday cadence AND we will be participating in the 2022 "Global Splunk User Group Week" which falls outside of our cadence as the 1st-week of April.

Splunk will be providing three $50 gift cards to the Splunk Store as prizes to randomly selected registered and checked-in attendees to this meeting!

The various layers of precedence can be exceedingly confusing and often the easiest way to figure out how it REALLY works is to just test it: but how can this be easily done? See how a combination of these allows for this to be done easily using only props.conf files (no transforms.conf) with either fully arbitrary data or structured JSON data with only these settings:
TZ (for arbitrary data for INDEX-TIME)
SEDCMD (for structured data for INDEX-TIME)
EXTRACT (either for SEARCH-TIME)

This will be BOTH a virtual event AND a live event @
UTD ROC building Rio Grande Conference Room 2.102
17217 Waterview Pkwy, Dallas, TX 75252, USA
DISPLAY PARKING PASS!

SPECIAL PARKING NOTE: Each visitor must display a temporary parking permit during our meeting which will shortly be available in the google drive folder link at the bottom. Be sure to only park in the “green” or “visitor” spaces as indicated: https://drive.google.com/file/d/1HVWwqh7OAhB0P5uOZTl2o63q5FMie-of

Feel free to start the conversation early in the #dallas channel of splunk-usergroups.slack.com (sign up with http://splk.it/slack).