Hi @gcusello , Just to get confirm that we went to the following location: Settings>>Access controls » Authentication method » LDAP strategies » LDAP Groups we found the required LDAP Group but Brian has already user,power role but it is not showing in selected role.Any reason? We need to just select dbx_user or user,power and dbx_user ? Reagrds, Rahul   ... View more

Hi @gcusello , We believe by adding dbx_user role to the user we can avoid this error. But when I am try to add its not getting added,How should I add this. Regards, Rahul ... View more

Hi @gcusello , could you please guide how to check this. Regards, Rahul   ... View more

Hi @gcusello , Yes,its different I am an admin where as he has a role of user & power. While running the search I am getting results where as he is getting error.what needs to be done to avoid this error. Do we need to grant him dbx_user role.if yes,I tried to edit his role but unable to do.what stopping me? Regards, Rahul ... View more

Thank you @gcusello legend. Regards, Rahul ... View more

Hi @gcusello , I ran the following query but able to get only last 30 days license uasge. Could you please suggest what modifications needs to be done to get last 90 days usage. index=_internal source=*license_usage.log* type="RolloverSummary" earliest=-90d@d | eval _time=_time - 43200 | bin _time span=1d | stats latest(b) AS b by slave, pool, _time | timechart span=1d sum(b) AS "volume" fixedrange=false | join type=outer _time [search index=_internal source=*license_usage.log* type="RolloverSummary" earliest=-90d@d | eval _time=_time - 43200 | bin _time span=1d | dedup _time stack | stats sum(stacksz) AS "stack size" by _time] | fields - _timediff | foreach * [eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)] Regards, Rahul ... View more

Hi @gcusello , We believe that we do not have a connection to extract logs from Oracle with that sourcetype, so we will create it.  who will help me with the following details,DBA Team?         Regards, Rahul ... View more

Hi @gcusello , I checked at the following location. Here is the following screenshot . And could not find sourcetype=wms_oracle_sessions. Regards, Rahul ... View more

Hi @gcusello , Yeah we are trying to configure DB Connect V1 dashboard. Actually,java bridge server was not working but now it is working.   But it's dashboard is not working. Following is the query of EW:Oracle Sessions By Program. index=main sourcetype=wms_oracle_sessions | bucket span=5m _time | stats count AS sessions by _time,warehouse,machine,program | search warehouse=ew | stats sum(sessions) AS psessions by _time,program | timechart avg(psessions) by program What could be done to solve this enigma. Help me,Legend. Regards, Rahul   ... View more

Hi @gcusello , sourcetype wms_oracle_sessions is not defined in inputs.conf,perhaps there is nothing there. [root@axxxfd01 local]# cat inputs.conf [root@axxxfd01 local]# Regards, Rahul ... View more

Hi @gcusello , I checked in props.conf but could not understand anything. what definition I should add in props.conf for sourcetype=wms_oracle_sessions. Regards, Rahul ... View more

Hi @isoutamo , We have three servers in our environment. Forwarder -- axxxfd05 Indexer      --axxxxlnd05 Search Head -- axxxhd05 Can you please suggest on which server I need to add definition in props.conf and how  will I come to know that I need to add definition in transformations.conf as well. What definition I need to add in props.conf  and reindex those events how it is done? Regards, Rahul   ... View more

Hi @gcusello , The following query I used index=symantec sourcetype="sep12:scan" status=completed |fields * |stats count and it worked. Thank you for your guidance. Regards, Rahul ... View more

Hi @renjith_nair , I used the following query index=symantec sourcetype=sep12:scan status=completed |fields * |stats count and it worked. Regards, Rahul ... View more

Hi @renjith_nair . I ran the following query index=symantec sourcetype="sep12:scan" |fields * and I could able to get events in fast mode. Please find the screen shot below. But it did not worked for index=symantec sourcetype="sep12:scan" status=*  Regards, Rahul ... View more

Hi @renjith_nair , I tried but it did not worked.Please find the screen shot below.   Regards, Rahul ... View more

Hi @gcusello , Please find the screen shot below.   Regards, Rahul ... View more

Hi @gcusello , I tried but it did not worked.     Regards, Rahul ... View more

Hi @gcusello , When you say flag status as interesting field ,what does it mean. Can you please elaborate more. Regards, Rahul ... View more