@pwoehl Did this worked? Just curious if its resolved and if you found the solution. ... View more

What happens if i have multiple tags for same sourcetype and index? Will it fail get into DM? ... View more

Can I configure something like this?  [default] persistentQueueSize=100MB   so that it will applied for all the inputs? ... View more

I have requirement and am not sure if i can achieve this through this method. For example if i create an Search whihc is not logging or down, and can i create a run a custom script to check by telnetting or ping for the results came from search? Is this possible? How i can pass the values of the hostnames to the script? ... View more

Do you know what is the frequency of arriving umbrella dns logs into s3 bucket? ... View more

Hi, Anyone figured out the way to integrate please?  ... View more

@richgalloway but in your steps i didnt see anything to convert bucket renames? Its not required? ... View more

Is it possible to do using python script having in backend? ... View more

I would like know, if this feature has added now? ... View more

hello, am looking for reference of field "rec_type" and what is actually means? I tried searching cisco documentation but no luck. Please share with me? the link @halfreeman @dkeck  ... View more

Hi, please specify what to insert in Transforms.conf ... View more

@harsmarvania57  I'm also having same problem. I'm doing it in HF. Note: My logs has headers. Does it causes the problem though? Props: [sourcetype::aws:cloudwatchlogs:vpcflow] TRANSFORMS-vpc = vpc_flowcustom Transforms: [vpc_flowcustom] REGEX = ^\s*(?P<account_id>[^\s]+)\s+(?P<version>[^\s]+)\s+(?P<interface_id>[^\s]+)\s+(?P<src_ip>[^\s]+)\s+(?P<dest_ip>[^\s]+)\s+(?P<src_port>[^\s]+)\s+(?P<dest_port>[^\s]+)\s+(?P<protocol_code>[^\s]+)\s+(?P<packets>[^\s]+)\s+(?P<bytes>[^\s]+)\s+(?P<start_time>[^\s]+)\s+(?P<action>[^\s]+)\s+(?P<end_time>[^\s]+)\s+(?P<log_status>[^\s]+)\s+(?P<vpc_id>[^\s]+)\s+(?P<subnet_id>[^\s]+)\s+(?P<instance_id>[^\s]+)\s+(?P<tcp_flags>[^\s]+)\s+(?P<type>[^\s]+)\s+(?P<pkt_srcaddr>[^\s]+)\s+(?P<vpc_region>[^\s]+)\s+(?P<pkt_dstaddr>[^\s]+)\s+(?P<az_id>[^\s]+)\s+(?P<sublocation_type>[^\s]+)\s+(?P<sublocation_id>[^\s]+)\s+(?P<flow_direction>[^\s]+)\s+(?P<traffic_path>[^\s]+)\s+(?P<pkt_src_aws_service>[^\s]+)\s+(?P<pkt_dst_aws_service>[^\s]+) WRITE_META = true ... View more