I am using a LWF to send Windows DHCP logs to an indexer using this configuration: [monitor://F:\dhcp] sourcetype = dhcp crcSalt = alwaysOpenFile = 1 disabled = false whitelist = Dhcp.+\.log The logs that end up on the the indexer look like this: 31,07/11/11,10:44:57,DNS Update Failed,10.1.60.56, . ,,,0,6,,, with a sourcetype of dhcp. I have copied and changed the props.conf to be this: [dhcp] TIME_PREFIX=\, TIME_FORMAT=%m/%d/%y,%T SHOULD_LINEMERGE=false REPORT-dhcp=win_dhcp_extract,win_dhcp_expired-deleted TRANSFORMS-dhcp=null_win_dhcp_header FIELDALIAS-1=dhcp_id as cef_sid FIELDALIAS-2=desc as cef_name LOOKUP-winDHCP-mac=winDHCP_mac-vendorname src_mac_prefix OUTPUT src_mac_vendor LOOKUP-winDHCP-CEF=winDHCP_CEF-lookup cef_sid OUTPUTNEW LOOKUP-winDHCP-message=winDHCP_message_lookup dhcp_id OUTPUTNEW Within the Windows DHCP app I don't have any data displayed; looking for some help on the configuration. ... View more