Sorry to be late to this party. The app can be installed on a HF. The HF can be on-prem and will poll data from Azure. There is some azure configuration required for the application to connect to your tenants. ... View more

Please?? Me 2 ... View more

Bump. Same question. How to get source address of sending router into the events. We have several netflow senders, no apparent way to distinguish original sender within the indexed flows. ... View more

Anticipating a 'did you try?', I also tried enclosing in these () e.g. Blacklist1 = (Message ="myregex"|EventCode="eventcode#" Message="Myotherregex") No joy ... View more

Old question, but still I found it searching for workarounds. Actually there is a limit on UF's, 10 blacklist entries per stanza within inputs.conf. I've hit the limit and for some reason my regex searches cant be combined. Namely those constructed like blacklist = Message="myregex" E.g. Blacklist1 = Message ="myregex"|EventCode="eventcode#" Message="Myotherregex" | etc does not parse. Only on separate lines do they work. It's this reason I've hit the limit. ... View more