About Adevill

Adevill · ‎06-17-2021

Hi @ejahnke . Where you able to get a successful connection? I'm having the same problem here...

Adevill · ‎04-12-2021

@gcusello ,thank you for all the assistance. I'll go back and check everything everything.

Adevill · ‎04-12-2021

Hi @gcusello As requested: [monitor://C:\Program Files (x86)\ABB Symphony Plus\Operations\History\PlantConnect.SYS\Debug\PlaCoEventImporter\Administrator_PlaCoEventImporter.log] disabled = 0 source = dcs sourcetype = dcs_event

Adevill · ‎04-12-2021

Hi @gcusello Yes, I'm sure, I've also double checked it and the spelling of everything.

Adevill · ‎04-12-2021

Ciao @gcusello I've tried both your suggestions (change the regex and put the conf files at indexer) but all the lines are still being indexed. Any other suggestions I can try?

Adevill · ‎04-12-2021

Ciao @gcusello Yes you are correct with all 3 points. The log file is being written to continuously, so I'm not sure if that will be seen as a single or multline event. I've used the below link for testing: https://regex101.com/r/3RmTnm/1

Adevill · ‎04-12-2021

Ciao Giuseppe @gcusello I've made the change you indicated but all the lines are still being forwarded. Any other advice? Regards Anton

Adevill · ‎04-12-2021

Hey all. I need help to selective forward (on a HF) from a log file that is being monitored by a UF. I only need to forward lines that contain the exact words "Read line". I've tried the below confs but the HF is still forwarding all lines that are written to the log. props.conf [dcs_event] TRANSFORMS-routing = dcs_allow,dcs_drop transforms.conf [dcs_allow] DEST_KEY = queue REGEX = (Read line) FORMAT = indexQueue [dcs_drop] DEST_KEY = queue REGEX = . FORMAT = nullQueue

Adevill · ‎03-18-2021

Hi @Vardhan Even if I try just 1 sourcetype it doesn't work. I've then removed the forwarding, then re-enabled it for all tags, which worked, then changed to a single sourcetype again which failed then again. Any other ideas?

Adevill · ‎03-17-2021

Hi @Vardhan Unfortunately it's also not working.

Adevill · ‎03-17-2021

Hey @Vardhan Yes, I'm trying to forward from HF to a test server at the moment, that's why the port 9997 doesn't matter now, but you are correct, I would have chosen a different one for deployment. Connectivity is not a problem as I can forward all data to the 2nd server, but it fails when trying to filter for only the 3 sourcetypes. The solution you suggested also didn't work unfortunately.

Adevill · ‎03-17-2021

Hi all. I need some help to index all data coming into one server and only forward 3 sourcetypes to a 2nd server. Receiving and indexing the data is not a problem, but I cannot seem to get the 3 sourcetypes to the 2nd server. Any help would be appreciated. My props.conf [cisco:asa] TRANSFORMS-routing=gsoc [icsp] TRANSFORMS-routing=gsoc [syslog] TRANSFORMS-routing=gsoc transforms.conf [gsoc] REGEX=. DEST_KEY=_TCP_ROUTING FORMAT=gsocPrimary and outputs.conf [tcpout] defaultGroup=nothing indexAndForward=true [tcpout:gsocPrimary] server=*.*.*.*:9997

Posts	12
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎03-17-2021

Online Status	Offline
Date Last Visited	‎06-17-2021 11:27 AM

Heavy Forwarder Selective forwarding

Index all and selective forward

Re: how to configure Mcafee Epo to send data to Sp...

Re: Heavy Forwarder Selective forwarding

Re: Heavy Forwarder Selective forwarding

Re: Heavy Forwarder Selective forwarding

Re: Heavy Forwarder Selective forwarding

Re: Heavy Forwarder Selective forwarding

Re: Heavy Forwarder Selective forwarding

Heavy Forwarder Selective forwarding

Re: Index all and selective forward

Re: Index all and selective forward

Re: Index all and selective forward

Index all and selective forward