Hi It is hard to tell if this should be a single event, or if it is multiple events. Assuming this is multiple events broken on a \n followed by date, the following should work props.conf [ mysourcetype] SHOULD_LINEMERGE=false LINE_BREAKER=(\n)\d{4} NO_BINARY_CHECK=true TIME_FORMAT=%Y-%m-%d %H:%M:%S,%3N ... View more

Please pay attention to the "order of operations" posted earlier. Fields from a previous step are available in subsequent steps except for calculated fields (they run in parallel), so, If you configure either an inline field extraction, or an additional Transforms that is executed first, then you would be able to use the field. E.g props.conf [sourcetype] EXTRACT-list = regex_to_extract_the_list REPORT-ip = ip_from_list transforms.conf [ip_from_list] MV_ADD = 1 SOURCE_KEY = list REGEX = c=IN\sIP4\s(\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}) FORMAT = IP::$1 ... View more

Hi The most likely suspect is the field "list" does not exist when the transform attempts to execute. Search time order of operations are Inline extraction from props Transform-based extraction Auto KV fields Field-Alias Calc fields Lookups Eventtypes Tags Can you please provide some insight into how/when the field "list" used as the SOURCE_KEY is extracted. Thanks. ... View more

Hi, Are you able to provide a sample of the data you are attempting to extract from. ... View more

From the doco. Other commands There are a handful of commands that do not fit into these categories. These commands are non-transforming, not distributable, and not streaming: sort, eventstats, some modes of dedup, and some modes of cluster. ... View more

Thanks MuS, As a pertner, I have contact also. I was hoping the community may have seen something like this elsewhere. I think there is something really screwed up int he backends somewhere. I will take this up with our partner account mgr. Thanks Again. ... View more

Thanks MuS. Unfortunately, this is not a suitable answer. Emailing random people within an organisation is not acceptable for something that should be able to be performed by the end user. I have checked, rechecked again and again, and there is no way for a user to edit their contact information (eg address, state, etc). The only items I can edit are my email and my phone. ... View more

Hi, Try removing the field "EVENT_SUB_TYPE" from the field list. The transaction command uses the field list to group events together and in your example, the contents of this field are actually different so you are getting 2 transactions with only a single event in them. ... View more

Hello, The following is the details of a bug that I raised last September. This was supposedly to fixed under SOLN-2157 but I have just checked the newest download and it has not been incoroporated. Can you please check and test/apply to see if this resolves your issue. Michael *** NEW SUPPORT CASE *** Case #: 98857 Thread ID: ref:_00D409oyL._50040MvSEm:ref Priority: P3 Subject: Coding issue with PDF Server App Description: Had minor issues getting this app to work fully. Whilst basic configuration was as per the docs, the app was unable to actaully display the PDF as a preview (from dashboard, action=schedule for delivery, then select preview), yet the preview worked from the manager -> system -> email alert, pdf server status page. After much digging it was found that when running the status page under system settings, the web port (443) was passed to the pdf app correctly, yet when runnging the preview of a scheduled job, the port was not passed. Digging into the code, a default value of "None" is applied if the port is not present, but further down the code checks for a value of -1. This behaviour was fixed by modifying the following in bin/pdfhandler.py (part of the pdfserver app) line 303, from if port == -1: to if port == -1 or port is None: line 660, from if target_port == -1: to if target_port == -1 or target_port is None: This ensures that the cert_overrides and cookie values are correctly created by the app. ... View more