Hey, actually, I am facing an issue, forwarding data via Tcpout. My scope is to forwarding some data to the main indexer and a subset of the data with specific props.conf to another but additionally keep the subset within the main indexer without using these additional props.conf setting.   Problem: Data is actual sent to both with using props.conf for both tcpout. sourcetype A  + sourcetype XXX ---> also using Props Props/Transforms (should be ignored) ---> Main Indexer sourcetype A ----> using Props/Transforms (required) --> Secondary Indexer   Scope: sourcetype A  + sourcetype XXX  ---> also using Props Props/Transforms ---> Main Indexer sourcetype A ----> Some Props/Transforms --> Secondary Indexer   Is there any solution to fix the problem?   Thank you for helping. Regards, Christoph ... View more

Hello Guys, I've run into a problem. I created a dashboard where you can edit and delete lookup entries by user input. The problem is that when the user deletes the last entry of the lookup, the header of the CSV disappears and when a Saved Search is run, it cannot find the defined fields. Does anyone have a solution to keep the header fields even if the last line is deleted, apart from creating a KV store? With friendly greetings Christoph ... View more