Dears, I'm trying to install Event Service 23.7 with Elastic Search 8  the scenario: 1- adding host by user root => and this is only applicable by the root user as I tried to make it by another user and go with SSH passwordless but it didn't work. ##if you advise adding hosts by different user okay I will share the error then for this.  2- after adding host by root, I go to events service            a- The default installation directory is /opt/appdynamics/platform/product/events-service/data and I change                       it to be /home/appd-user/appdynamics-event-service-path/ in this way I get error                    #Unable to check the health of Events Service hosts [events-03, events-02, events-01] through port 9080                       or it runs and then stops in seconds.                   #and in logs elastic search stopped => cause running by root user                   #my question here is also, why does the installation of events service in each service go under                                                     /opt/appdynamics to solve this issue I have added the hosts with appd user but in each event service server  sudo chown -R appd:appd /opt/ sudo chmod -R u+w /opt/ the adding host went well and the installation of the event service went well but some of the event services stopped with an error elastic search running with the root user even it's run with appd user. and to solve this issue I have run manually from each server  bin/events-service.sh stop -f && rm -r events-service-api-store.id && rm -r elasticsearch.id nohup bin/events-service.sh start -p conf/events-service-api-store.properties & but anyway, I see all of this is work around and I want something more stable and I'm sure someone will guide me with the right steps.  BR Abdulrahman Kazamel

I am running query ->  index=* source="/somesource/*" message "403" | search level IN (ERROR) And Response is --> { "instant": { "epochSecond": 1707978481, "nanoOfSecond": 72000000 }, "thread": "main", "level": "ERROR", "message": "Error while creating user group", "thrown": { "commonElementCount": 0, "extendedStackTrace": "403 Forbidden:" }, "endOfBatch": false, "threadId": 1, "threadPriority": 5, "timestamp": "2024-02-15T06:28:01.072+0000" } Now, when i ran following query -> index=* source="/somesource/*" message "403" | search level IN (ERROR) | eval Test=substr(message,1,5) | eval Test1=substr(thrown.extendedStackTrace, 1, 3) | table Test, Test1 I am getting value for Test. Correct substring occuring (Output is Error). But for Test1, its empty string, where as I am expecting 403. As message is on root, its working, but the extendedStackTrace is under thrown, the thrown.extendedStackTrace is not rending the correct result. Although, if i do ...| table Test, Test1, thrown.extendedStackTrace There is a proper value coming in for thrown.extendedStackTrace What am i missing?

Hello Team, Required help regarding below points : 1] how to add entry of  the ran search with the fields Host, SourceIP and DestinationIP into lookup table. 2] how to add entry into lookup table from the notable triggered or contributing events of the notable.   Requirement here is that need to create co relation rule from the lookup values which will be taking from previously triggered notables.