Be aware that because the LINE_BREAKER contains \s, your data might actually get broken on every space, tab... ... View more

Hmmm. Are you in fact using the sourcetype already provided in the TAs referenced here? If so and still having problems it might be stronger to start a new question (feel free to cross reference this one) and provide greater detail. ... View more

Peter, I developed a report that runs each week, and sends me the reults fo the following search string: index=_audit source=audittrail operation=edit action!=search action=edit_roles You could modify this search with other parameters that suit your particular needs or frequency. The above, will show you all mods made to the admin role. I hope that helps. Thanks! ... View more