Hello,
I'm curious what my options are for the given scenario. We have the stealthbits file monitoring app that works decently well in regards to its saved searched and dashboards, but when looking through the events and how they are extracted they have a few values that are incorrect. I don't want to get rid of the whole app, but I want to make sure all fields get extracted. Outside of contacting the vendor, which we already did, is there anything else I can do?
Could I just use the extract fields option on the search head and extract fields that are incorrect? Do I need to go into the regex of the app and actually find the bug? Or possibly creating a new app that extracts just the fields that are mapped incorrectly and then use that source type whenever I search for those fields?
Let me know if you can think of any other work around to this, thank you!
