Hello everyone! Consider the following situation: 2 sites (A and B) 2 indexers in site A: idxa1, idxa2 2 indexers in site B: idxb1, idxb2 Is possible to restrict site replication in a way that the pair idxa1 and idxa2 be mirrorred respectivaly to idxb1 and idxb2 ? I don't wanna replicate idxa1 data into idxb2 server or idxa2 data into idxb1 server. There is a way to do it? Based on your experience, I can get any future issue (administration or performance). Thank you. ... View more

Hi everyone! From the beginning of daylight savings, every event indexed by 1 hour, got a wrong timestamp, something like "0:00:00 1-1-1970". It's the second time that I got this problem but I didn't found any answer and solution for this. Do you know if it's a bug and how to workarround this ? Thanks you all! ... View more

Hi! I would like to know if is possible to search for multiples URLs in vtlookup because i have a search that returns many URLs that i would like to test. Example: This is my query: source="proxy_logs" category="*unrated*" | stats count by username srcip url And this is my return: username | srcip | url | count user1 | 10.0.0.1 | www.site1.com | 5 user2 | 10.0.0.2 | www.site2.com | 7 user3 | 10.0.0.3 | www.site3.com | 8 I would like to do something this way: | script vtlookup \_\_EXECUTE\_\_ [search source="proxy_logs" category="*unrated*" | stats count by username srcip url | fields - count | return $url] | spath input=vt | rex field=vt "\"total\":\s+(?\d+)" | rex field=vt "\"positives\":\s+(?\d+)" | eval Rate="Detection (".vt_positives."/".vt_total.")" | table username srcip url Rate To get this result: username | srcip | url | count | Rate user1 | 10.0.0.1 | www.site1.com | 5 | Detection (6/60) user2 | 10.0.0.2 | www.site2.com | 7 | Detection (56/60) user3 | 10.0.0.3 | www.site3.com | 8 | Detection (0/60) But it doesn't works. Someone can help me? Thanks in advance! ... View more