Hi @gcusello , it works for that specific case, however my extracted field ErrDesc will not always have pipe "|" inside, basically I want to match anything until |" , no matter if pipe is in the field or not

Hello I´ve upgraded DB connect app. from version 3.** to 3.15 not long time ago but I could configure it without any issues. I´ve start to receive this error only recently. I´m also attaching port related message. I was also trying to downgrade DB connect app. according the instructions but when I change from DONE to PENDING I see no difference it´s still 3.15.0.

Hello Ryan, Thanks for the response. Just to note here we have already configured the database collector and the link which you have shared is to achieve this configuration. However we just want to have clarity on below points. 1. Is AppD Db agent capable of detecting Ora errors in Oracle DB? 2.If yes whether can we detect ORA-00600 error via AppD Db agent? Please let us know the process for the same.

In the process of raising a Splunk case I was able to find a Knowledge Article (000012459) that explained how to install the Splunk UF as the LocalSystem user as was previously standard:   Resolution For silent installation, a Windows universal forwarder from the command line to use LOCAL_SYSTEM account (which is not a security best practice) looks like below: msiexec.exe /i splunkforwarder-9.1.2-b6b9c8185839-x64-release.msi LAUNCHSPLUNK=0 AGREETOLICENSE=Yes GENRANDOM PASSWORD=1 SERVICESTARTTYPE=auto USE_VIRTUAL_ACCOUNT=0 USE_LOCAL_SYSTEM=1 /quiet by using flags: USE_VIRTUAL_ACCOUNT=0 USE_LOCAL_SYSTEM=1       

Hi @iainp, you could try something like this: index="mydevices" logdesc="Something that speeds the search" earliest=-7d@d latest=now | eval period=if(now()-_time<1800,"Last 30 minutes","Previous") | stats dc(period) AS period_count values(period) AS period count BY devicename | where period_count=1 period="Previous" | table devicename See my approach and adapt it to your Use Case. Ciao. Giuseppe