Thank you - this was exactly what I was trying to figure out.  I had a regex and couldn't figure out why only part of it was disappearing.  I didn't understand about the capture group. ... View more

Thank you MuS, you have confirmed that it can be done. I'll go back to the lab and test out a solution. Thanks, Paul ... View more

Is the "Events Indexed" number telling me how many events were indexed up to that point, or the number of events that are indexed currently (as in the buckets and available for searching)? I'd like to track that number, but per indexer, in the case of file corruption or something similar. I'll try your second query and see what I get. Thanks, Paul ... View more

I recently implemented this and it worked as expected. I might make some further enhancements to include the Management Pack that the rule or monitor lives in that generated the event or alert in the first place. We like to see that info as well. ... View more