Thanks - I tried this but received the same result. ... View more

Have you assigned the sourcetypes? this app seems to be driven by macros. So what I would do, is take a look at the macros and run them separately in the search view. (run the search code, not the macro). In other words, take it apart a bit to see what might be out of alignment The macros are found this way. From the App Dashboard Screen Select the Settings Menu> Select the Advanced Search> Select the Search Macros> Examine the list and see if something jumps out... cut and past the Search code into the search view and run it. See what it gets you. ... View more

Thank you so much! This is extremely helpful for any event id pulled from the Windows Security Log. Often there are 2 or 3 fields named the same (e.g. Account_Name) and you only want to pull the one value out. Kristian's answer solved my issue big time. ... View more

Hi, and thanks for the feedback. I have not really touched this stuff since I wrote it more than a year ago. However I don't remember seeing figures that were so wildly off. Could it be that something changed since 4.3? If you want to refine it, you should probably use the rest search approach instead of the license-usage.log (as mentioned by Ayn above). It is faster and I believe that this is what is used in Manager -> Licenses. As for the compressed thing: No. License is measured as uncompressed data to be indexed. ... View more