It does not work. It taks findes only the timestamp from this log entry: 2014-02-17 08:32:54,248 [[ACTIVE] ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)'] DEBUG ch.sympany.clientportal.servlet.StartupServletContextListener - StartupServletContextListener initialised. The best filter i have create is this one: [my_sourcetype] MAX_TIMESTAMP_LOOKAHEAD = 50 TIME_PREFIX = \[EL Finest]:|\[EL Finer]:|\[EL Config]: |\< But the result is not 100%. Any ideas in this way? ... View more

It appears that the capability: edit_scripted is required to use "runshellscript" without this capability, I was getting the error described above, with the capability, it works fine. ... View more