When you say to have moved it to a distributed architecture, what do you mean? You would want to run the app with a configured account on a single machine like a heavy forwarder, or maybe on your search head. Be sure to only configure 1 server to perform the collection, lest bad things (like duplication) may happen. If your installing on multiple servers, it will nag you on each to run the setup - to bypass this add "is_configured = true" in the local/app.conf . Maybe i'll add that option in 1.0.6 ... View more

My use case was a little different, I was trying to remove Account_Name = "-" from sourcetype = ActiveDirectory, and the where clause was the only method that I could find that produced the results I needed. Thanks! ... View more