Thank you, I think found another post of yours. I've replicated, in my environment with success.
Many thanks!!
You comment here from Jan 17th
https://answers.splunk.com/answers/666758/import-azure-nsg-logs.html
... View more
Would you be able to provide syntax in transform and props files?
I am having a similar issue and I not sure where the LINE_BREAKER or SEDCMD would go in file.
... View more