Hello community,   I am trying to "reroute" specific logs (based on Regex match) to a different index. This is done on the heavy-forwarder. It is ingested via syslog. Both props and transform are in the correct folder where syslogs events are ingested. I have created a ruleset in props.conf:   [vmware] TRANSFORMS-include = reroute_to_indexA   And here is the config from transform.conf:   [reroute_to_indexA] SOURCE_KEY = _raw REGEX = ^.*2300-.*$ DEST_KEY = _MetaData:Index FORMAT = index-a   Last but not least here is a sample of the logs I am working with:   Jul 5 09:02:11 10.32.37.214 1 2022-07-05T09:02:11.339-04:00 2300-RDSH-1-2 View - 1009 [View@6876 Severity="INFO" Module="Agent" EventType="AGENT_DISCONNECTED" UserSID="omitted" UserDisplayName="omitted" PoolId="2300-rdsh-farm1" MachineId="omitted" MachineName="2300-RDSH-1-2" MachineDnsName="2300-rdsh-1-2" CurrentSessionLength="180" TotalLoginLength="180" SessionType="APPLICATION"] User omitted has disconnected from machine 2300-RDSH-1-2     At this point I would have expected to see the logs being written to index-a. What have I done so far as troubleshooting: Remove SOURCE_KEY Replace SOURCE_KEY = _raw with field:MachineDnsName Replace SOURCE_KEY = _raw with fields:MachineDnsName Substituted the REGEX for .*2300.* and .*2300-.* Nothing have helped so far; any help or pointers would be greatly appreciated.   Thank you,         ... View more

Good day, We are looking at a solution to alert us on abnormal traffic spike. We have leverage the standard deviation, and `streamstats` for the moving average. We are "graphing" for the last 2 hours. Last but not least, there is a cron job running every 2 minutes. Below is the query:   base_search earliest=-121m@m latest=-1m@m | bin _time span=2m | stats count by _time | streamstats avg("count") AS avg stdev("count") AS stdev | eval upperBound=(avg+stdev*exact(2)) | eval isOutlier=if('count' < lowerBound OR 'count' > upperBound, 1, 0) | eval avg=round(avg,0) | eval upperBound=round(upperBound,0) | rename count as "Events" upperBound AS"Upper Limit" isOutlier AS"Is Outlier" avg AS "Average" | fields _time, "Events", "Average", "Upper Limit", "Is Outlier" | search "Is Outlier"=1     The problem I am encountering is once there is a "Outlier" it will remain in the table for the next 2 hours. i.e. Outlier a 7:31am on the next schedule run at 7:32am it will trigger. But the entry will still show up at 7:34am, 7:36am, and so forth. I tried using the following arguments but it doesn't work.   | search "Is Outlier"=1 earliest=-2m@m latest=now()   Does anyone has any idea how I can have the alerts show the last two minutes, but retaining the 2 hours moving average? Thank you in advance!   ... View more