We have created an app with Navigation and some Simple XML reports. When we go to the first report and select a datetime range and after that we use the navigation menu to go to the next report the selected datetime range is lost and we need to select the datetime range again. Is is possible to keep the previous datetime range value? We tried to use tokens, but that is only used for the current report. Are there some kind of global session or tokens that can be used within an app? We could use a drilldown link within our report that takes the token earliest and latest modifier and use those tokens to drilldown to the report, but is this also possible within the navigation? ... View more

Hi I want to create a macro with at least 1 argument and maximum 20 arguments. So I created 20 macros. (See example below. I only displayed 3 of them and leaved out some other statements.) Is there a other way to do this? Example of my current macros.conf file: [get_type(3)] args = field_1, field_2, field_3 definition = ... | where (my_field=$field_1$ OR my_field=$field_2$ OR my_field=$field_3$) | ... [get_type(2)] args = field_1, field_2 definition = ... | where (my_field=$field_1$ OR my_field=$field_2$) | ... [get_type(1)] args = field_1 definition = ...| where my_field=$field_1$ | ... ... View more

I'm trying to define a custom sourcetype. I have one file with multiple XML files. For example MyFile.xml: <?xml version = '1.0' encoding = 'UTF-8' standalone = 'yes'?><DATA> <Time>2016-02-12T00:00:00.211Z</Time> <Item> <ID>1545454</ID> <VAR1>897654564dDJUHFKHJHEU</VAR1> </Item> <Check>OK</Check> </DATA> <?xml version = '1.0' encoding = 'UTF-8' standalone = 'yes'?><DATA> <Time>2016-02-12T00:00:00.211Z</Time> <Item> <ID>456849836848</ID> <VAR5>78964DFDFli_DFDFD_DFDF</VAR5> </Item> <Check>FAILD</Check> </DATA> <?xml version = '1.0' encoding = 'UTF-8'?><LOG> <Send>FKK_64646464</Send> <TimestampSend>2016-02-08T04:44:53.417Z</TimestampSend> <By>MFF_5687654</By> <MessageId>Title Test</MessageId> <Message> <Resp> <EventTime>2016-02-08T04:44:53.418Z</EventTime> <Info> <Item> <Id>INFO_222</Id> </Item> <Description> <Id>BCC_456</Id> <ByID>45</ByID> </Description> </Info> <Status>404</Status> </Resp> </Message> </LOG> <?xml version = '1.0' encoding = 'UTF-8' standalone = 'yes'?><DATA> <Time>2016-02-12T00:00:00.211Z</Time> <Item> <ID>45454545</ID> <VAR88>LJDKI_DFDFDF_DFDFDF_EJRHUHEJK</VAR88> </Item> <Check>WARNING</Check> </DATA> <?xml version = '1.0' encoding = 'UTF-8'?><LOG> <Send>FKK_64646465</Send> <TimestampSend>2016-02-08T04:48:53.417Z</TimestampSend> <By>MFF_5687655</By> <MessageId>Title Test</MessageId> <Message> <Resp> <EventTime>2016-02-08T04:48:53.418Z</EventTime> <Info> <Item> <Id>INFO_223</Id> </Item> <Description> <Id>BCC_457</Id> <ByID>46</ByID> </Description> </Info> <Status>404</Status> </Resp> </Message> </LOG> My props.conf [mysourcetype] DATETIME_CONFIG = CURRENT KV_MODE = xml LINE_BREAKER = (<?xml) NO_BINARY_CHECK = 1 SHOULD_LINEMERGE = false TRUNCATE = 0 pulldown_type = 1 How can I set the LINE_BREAKER by "<?xml version = '1.0' encoding = 'UTF-8' standalone = 'yes'?>" Is there a way te set the DATETIME to or with regex? What did I do wrong? ... View more