About manan_amin

manan_amin · ‎07-22-2020

In Eval, We can use string format function (replace) to replace "\" by two "\\". Here, We need to escape "\" two times, One of the way to replace it, props.conf EVAL-new_path = replace(path ,"(\\\\)","\\\\\1") in Search Query: | eval new_path = replace(path ,"(\\\\)","\\\\\1")

manan_amin · ‎07-22-2020

eval new_path = replace( old_path ,"(\\\\)","\\\\\1")

richgalloway · ‎07-09-2020

IMO, the events you describe are covered by separate data models. Authentication, Network Session, Endpoint, etc. Use the model that contains the events you need for the use case. It's possible to use more than one data model in a search.

manan_amin · ‎06-01-2020

What if Same input is rescheduled and first one is still running.. option A -> First one stops, Second one Starts option B -> First continues, Second will be skipped option C -> Both run concurrently For Example, the interval is 60 Seconds and After a minute my first one(modular input) is still running

Posts	4
Solutions	1
Karma Given	4
Karma Received	4
Member Since	‎04-21-2020

Online Status	Offline
Date Last Visited	‎07-30-2020 11:00 AM

Best CIM data Model for User Activities Data

What if Same input (Modular Input) is rescheduled ...

Re: How to replace backslash by double backslash u...

Re: replace one backslash by double backslash

Re: Best CIM data Model for User Activities Data

What if Same input (Modular Input) is rescheduled ...