Hi @PickleRick , there's still something wrong: I used this props.conf: [logstash] TRANSFORMS-00_sethost = set_hostname_logstash TRANSFORMS-01_setsource = set_source_logstash_linux TRANSFORMS-05_setsourcetype_linux_audit = set_sourcetype_logstash_linux_audit TRANSFORMS-06_setsourcetype_linux_secure = set_sourcetype_logstash_linux_secure TRANSFORMS-50_drop_dead_linux_audit = drop_dead_linux_audit TRANSFORMS-51_drop_dead_linux_secure = drop_dead_linux_secure [linux_audit] TRANSFORMS-0_drop_all_except_proper_ones_linux_audit = drop_dead_all,keep_matching_events_linux_audit #TRANSFORMS-conditional_host_overwrite = conditional_host_overwrite TRANSFORMS-cut_most_of_the_event_linux_audit = cut_most_of_the_event_linux_audit [linux_secure] TRANSFORMS-0_drop_all_except_proper_ones_linux_secure = drop_dead_all,keep_matching_events_linux_secure #TRANSFORMS-conditional_host_overwrite = conditional_host_overwrite TRANSFORMS-cut_most_of_the_event_linux_secure = cut_most_of_the_event_linux_secure and this transforms.conf # set host=host.name [set_hostname_logstash] REGEX = \"host\":\{\"name\":\"([^\"]+) FORMAT = host::$1 DEST_KEY = MetaData:Host # set source=log.file.path per linux_audit e linux_secure [set_source_logstash_linux] REGEX = \"log\":\{\"file\":\{\"path\":\"([^\"]+) FORMAT = source::$1 DEST_KEY = MetaData:Source [set_sourcetype_logstash_linux_audit] REGEX = \"log\":\{\"file\":\{\"path\":\"(/var/log/audit/audit.log)\" CLONE_SOURCETYPE = linux_audit [set_sourcetype_logstash_linux_secure] REGEX = \"log\":\{\"file\":\{\"path\":\"(/var/log/secure)\" CLONE_SOURCETYPE = linux_secure [drop_dead_linux_audit] REGEX = sourcetype:linux_audit DEST_KEY = queue FORMAT = nullQueue [drop_dead_linux_secure] REGEX = sourcetype:linux_secure DEST_KEY = queue FORMAT = nullQueue [drop_dead_all] REGEX = . DEST_KEY = queue FORMAT = nullQueue [keep_matching_events_linux_audit] REGEX = sourcetype:linux_audit DEST_KEY = queue FORMAT = indexQueue [keep_matching_events_linux_secure] REGEX = sourcetype:linux_secure DEST_KEY = queue FORMAT = indexQueue [cut_most_of_the_event_linux_audit] REGEX = (?ms).*\"message\":\"([^\"]+).* FORMAT = $1 DEST_KEY = _raw WRITE_META = true [cut_most_of_the_event_linux_secure] REGEX = (?ms).*\"message\":\"([^\"]+).* FORMAT = $1 DEST_KEY = _raw WRITE_META = true but with this configuration I lost linux_audit tranformation and the remove of extra contents does,'t run. Your approach is correct, but probably there's something wrong i my application. Now I try to understand where's the issue. Thank you again for your help  Ciao. Giuseppe

@richgalloway's solution is one of the possible answers. It has its pros and cons. The other possibility is to search for all events, do a lookup on them and find non-matched ones. <your_search> | lookup your_lookup match_field OUTPUT match_field AS new_match_field | where isnull(new_match_field  Typically you'd use mine option later in the search pipeline while @richgalloway 's solution would probably be more suitable in the initial search.

It's not that easy 1. Often overlooked thing - timechart with span=something means just chopping time into span-sized slices. It does _not_ mean doing a sliding window aggregation. I suppose you can't do that other way than using streamstats. 2. limit=X with timechart gives you only X top results _overall_, not per each bin.

As with any requirement that is critical and is not sufficiently well docummented - I'd say try and see. Configure your test environment with IPv6, set up a data source for the DBConnect and verify if it works. I don't see a reason why it shouldn't as long as your OS has properly configured IPv6 layer and your JVM can handle it (which should be a no-brainer - java has supported IPv6 connectivity for a long time now). But there can always be some unexpected quirks (like for example - some component could expect only IPv4 formatted addresses and couldn't handle IPv6 ones).

The general form is <<some search that returns field 'foo'>> NOT [ | inputlookup mylookup.csv | field foo ] If the lookup file does not contain 'foo' then you'll need a rename command to change what it has to 'foo'.

Hi @AL3Z, sorry but I continue to not understand: are you speaking of an activiy on Splunk or on a target system? if on Splunk, it depends on the action that you associated to the alert(you can create a Noteble, send an eMail, write in an index or i a lookup, etc...) if on the target system, it depends on how you ingest logs from the target system. Ciao. Giuseppe

Also remember that trial Cloud installation does not fully support HEC over TLS. I don't remember the details though - either you get only unencrypted connection or get the TLS-enabled port but only with some self-signed cert on the server's side.