Hi - we upgraded the Forwarder to Version 7.3.6 (For W2012 svr) from 7.3.0 in the the hope this would cure the problem with the Forwarder restarts per the release notes below, but the issue outlined previously has occurred again. Can you just confirm this is definitely a problem at the UF end rather than at the Indexer end given the nature of the error ? Many Thanks! 2020-05-07 SPL-188620, SPL-184263 UFs stop forwarding after some time and need constant restarting ... View more

Hi - ignoring the Answer below can anyone help please ? THANKS !! ... View more

Yep, thats exactly whats occurring Guiseppe ! We will get the correct Timestamp format added to the non-standard data. Many Thanks! Nick ... View more

I did some tests adding one of the NOT statements at a time and the amount of events returned reduced accordingly each time, so i'm 99.99% sure the revisions suggested are doing the job.....but will monitor over the next week to be 100% certain 🙂 ... View more

Hi Rich - got there I think .... After finding the target records I add your suggested search and then | table Target_File to the end of it.... This returns 'no results found' into the Dashboard Panel if, as expected, no duplicates are detected.......and the Target_file value should a duplicate be detected. So your suggestion was spot on, I just needed to suss the end bit. Many Thanks for your guidance! ... View more