Don't know what you mean by 'options are disabled'? Did you mean to say that in props.conf on the indexer you have a stanza like: [source::WinEventLog:Security] sourcetype=tcp-raw In that case, just remove that and the new events coming in should be fine. ... View more

@cphair, I think I understand your question, maybe. if you know username and domain will always appear together. If you wanted to preform multiple field extractions in the statment you might want to use the |(pipe) to make the match optional. Keep in mind that using the |(pipe) following alternative will be tried if the regex backtraces into the group. ... View more

Good point Gilberto! And a big timesaver. You could download that app and then all the lookups would work assuming the field names for the lookup match to the field names he is using. An easy fix either way. ... View more