Hi All, Does anyone know the exact order index parsing is completed?  Reason being, i have a 1 log file that i'd like to parse two different time stamps from.  I was going to assign source type A to it, then at parsing use transforms to either assign source type "A:A" or "A:B" to it and pull the time from there.  However it appears timestamps are pulled before this step.   Thoughts? ... View more

Trying to route windows application logs to correct index based on event data. The scenario I have XmlWinEventLogs coming in normally using TA for windows and they head to the winos index.  I would like to redirect some specific events to a different index.   Props.conf [source::XmlWinEventLog:Application] TRANSFORMS-citrix_xa_index = citrix_xenapp_index Transforms.conf [citrix_xenapp_index] REGEX = Citrix DEST_KEY = _MetaData:Index FORMAT = citrixxa This should route all events containing "Citrix" to the citrixxa index.  My question is the order of operation?  Do Index redirects have to be performed before any other say sourcetype renaming that the windows TA does? ... View more