Hello all, I have a doubt in my routing configuration. I'm using an HF and I configured an app to perform some routing (but it's more like a replication) to a syslog server of a specific sourcetype. This is my props.conf [sourcetype::XmlWinEventLog] TRANSFORMS-XMLWin = send_to_IDX, send_to_syslog and here is my transforms.conf [send_to_syslog] REGEX = . DEST_KEY = _SYSLOG_ROUTING FORMAT = SGroup [send_to_IDX] REGEX = . DEST_KEY = _TCP_ROUTING FORMAT = idx_core I have a locally (to the app) defined outputs.conf [syslog] [syslog:SGroup] server = X.X.X.X:601 priority = <190> type = tcp timestampformat = "%d/%m/%Y %H:%M:%S" and the idx_core is defined in a global outputs.conf Now my doubt is how the transform will execute and tag the events. In my understanding, the order of transforms is important and so the REGEX filter in the specific transform stanza. So if I run first the transform "send_to_IDX", ALL the events (matched by REGEX=.) will be tagged to be sent to tcprouting idx_core, so when the transform "send_to_syslog" runs, no events will be routed to the syslog. Is my assumption correct? If so, how can I do this double routing of that specific sourcetype? thanks, Fausto ... View more

Hello, I have this checkbox in my dashboard: <input type="multiselect" token="t_case" searchWhenChanged="true"> <label>Cases</label> <search base="base"> <query>| dedup Rule</query> </search> <delimiter> , </delimiter> <fieldForLabel>Rule</fieldForLabel> <fieldForValue>Rule</fieldForValue> <default>FUAA01,NML02,WML01,WML02</default> <valuePrefix>count(eval(Rule="</valuePrefix> <valueSuffix>")) AS $value$</valueSuffix> </input> the problem is valueSuffix, it seems cannot be "dynamic" (i.e. the suffix is totally missing because it seems it cannot evaluate $value$ and it's totally lost). this token is evaluated in a chart command and this should be the final output (with two selected values, for example): chart count(eval(Rule="FUAA01")) AS FUAA101 , count(eval(Rule="NML02")) AS NML02 over date_month by CustomerID Is there a way to achieve that, only with XML? thanks, Fausto ... View more