Hello team, I am facing an issue with multiple events getting merged as a single event in tier 3. I do not have this issue with tier 1 or when I manually run the saved search. However when the saved search runs at a scheduled time these multiple events gets merged as 1 single event. I even tried adding the below values in props.conf of Data App but did not help [sourcetype::_json] SHOULD_LINEMERGE = false LINE_BREAKER = ([\r\n]+)\d{2}\/\d{2}\/\d{4}\s\d{2}:\d{2}:\d{2}\s\+\d{4}   Below is how the event in tier 3 is like: 03/28/2024 10:35:00 +0000,search_now=1711622100.000000000,source_host="1.1.1.1 : ip-sample_ip.ec2.internal",metric_label="Port_Connectivity : Reporting no data",instance="Port : 45",metric_value="0",metric_unit="latest",alert_value="100",tower="Port reporting no data",threshold1="-2",threshold2="-1",threshold3="0.5",threshold4="0.5",blacklist_alerts="1",add_info="Time=1711622100.000000;!@#;state=offline;!@#;message=NA;!@#;protocol=NA;!@#;responsetext=NA;!@#;responsetime=1711622100.000000;!@#;returncode=NA;!@#;roundtriptime=NULL;!@#;service_name=NA;!@#;app_context=port_data"03/28/2024 10:35:00 +0000,search_now=1711622100.000000000,source_host="1.1.1.1 : ip-sample_ip.ec2.internal",metric_label="Port_Monitoring : Port_Status",instance="Port : 45",metric_value="201",metric_unit="Status",alert_value="100",tower="Infra",threshold1="0",threshold2="0",threshold3="300",threshold4="500",blacklist_alerts="1",add_info="Time=2024-03-28T10:33:48Z;!@#;state=reachable;!@#;message=reachable;!@#;protocol=UDP;!@#;responsetext=/bin/sh: line 1: nc: command not found;!@#;responsetime=na;!@#;returncode=0;!@#;roundtriptime=NULL;!@#;service_name=IMP;!@#;app_context=port_data"03/28/2024 10:35:00 +0000,search_now=1711622100.000000000,source_host="127.0.0.1 : ip-sample_ip.ec2.internal",metric_label="Port_Connectivity : Reporting no data",instance="Port : 3389",metric_value="0",metric_unit="latest",alert_value="100",tower="Port reporting no data",threshold1="-2",threshold2="-1",threshold3="0.5",threshold4="0.5",blacklist_alerts="1",add_info="Time=1711622100.000000;!@#;state=offline;!@#;message=NA;!@#;protocol=NA;!@#;responsetext=NA;!@#;responsetime=1711622100.000000;!@#;returncode=NA;!@#;roundtriptime=NULL;!@#;service_name=NA;!@#;app_context=port_data" Every event will end at "app_context=port_data"" to be exact. Please let me know how to resolve this. ... View more

Hello all, I have a Japanese language windows server from which I am testing to push the data to Tier1 index. However, although the language settings in the server is Japanese, all the data is pushed as English. Adding the inputs and props file that is configured as below on the UF in windows server. Please let me know how do I do this. inputs.conf: ###### OS Logs ###### [WinEventLog://Application] disabled = 0 start_from = oldest current_only = 0 checkpointInterval = 5 # only index events with these event IDs. whitelist = 0-2000,2001-10000 index = acn_infra360-wineventlog_default_tier1_idx _TCP_ROUTING = winevent_dev1 renderXml=false [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 checkpointInterval = 5 # only index events with these event IDs. whitelist = 0-2000,2001-10000 index = acn_infra360-wineventlog_default_tier1_idx _TCP_ROUTING = winevent_dev1 renderXml=false Props.conf: [WinEventLog://Application] description = Windows Event Monitoring CHARSET = SHIFT-JIS BREAK_ONLY_BEFORE = \d{2}/\d{2}/\d{4} \d{2}:\d{2}:\d{2} TIME_FORMAT = %m-%d-%Y %T sourcetype = WinEventLog:Application [WinEventLog://Security] description = Windows Event Monitoring CHARSET = SHIFT-JIS BREAK_ONLY_BEFORE = \d{2}/\d{2}/\d{4} \d{2}:\d{2}:\d{2} TIME_FORMAT = %m-%d-%Y %T sourcetype = WinEventLog:Security Also, attaching the screenshot of the event viewer from the server. ... View more

Hello all,   I am trying to exclude an specific value within a field while retaining others. Can you please let me know.   Eg values: 1) /Server/Cpu/load/Login 2) /Server/Memory/usage 3)/Load/usage/value   These above are the values extracted form the event and I will have to remove only /Server value from the field while retaining all other values from the event. Expected values needed: 1) /Cpu/load/Login 2) /Memory/usage 3) /Load/usage/value   Please help in getting this.   ... View more

Hello all,   I have been facing problem with the below extraction where the extraction is working on a few events and not on others. Please help on how this can be fixed.   Below are the different kind of alerts:   The extraction is working as expected on the below alert: 50271234,00004105,00000000,1600,"20210901225500","20210901225500",4,-1,-1,"SYSTEM","","psd217",46769359,"MS932","Server-I ジョブ(Server:/新基幹_本番処理/値札発行/04_値札指示データ連携_午前1TAX/V9B01_B:@5V689)を開始します(host: UXC510, JOBID: 56620)","Information","User","/App/App/Server","JOB","Server:/新基幹_本番処理/値札発行/04_値札指示データ連携_午前1TAX/V9B01_B","JOBNET","Server:/新基幹_本番処理/値札発行/04_値札指示データ連携_午前1TAX","User:/新基幹_本番処理/値札発行/04_値札指示データ連携_午前1TAX/V9B01_B","START","20210901225500",""   The same extraction is not working on the below alerts and is extracting the underlined red fields which is not expected and need to extract the green marked fields. 50271233,00004125,00000000,1600,"20210901225500","20210901225500",4,-1,-1,"SYSTEM","","psd217",46769358,"MS932","KAVS0278-I ジョブ(AJSROOT1:/新基幹_本番処理/値札発行/04_値札指示データ連携_午前1TAX/V9B01_B:@5V689)のサブミットを開始します","Information","User","/App/App/Server","JOB","Server:/新基幹_本番処理/値札発行/04_値札指示データ連携_午前1TAX/V9B01_B","JOBNET","Server:/新基幹_本番処理/値札発行/04_値札指示データ連携_午前1TAX","User:/新基幹_本番処理/値札発行/04_値札指示データ連携_午前1TAX/V9B01_B","START","20210901225500","" 50271226,00004106,00000000,3088,"20210901225446","20210901225446",4,-1,-1,"SYSTEM","","psd240",316413750,"MS932","Server-I ジョブ(Server:/新基幹_本番処理/MCS/監視/09_注文送信未更新項目チェック/EDI送信情報リスト_HULFT送信:@50R6189)が正常終了しました(host: PSC666, code: 0, JOBID: 88039)","Information","User","/App/App/Server","JOB","Server:/新基幹_本番処理/MCS/監視/09_注文送信未更新項目チェック/EDI送信情報リスト_HULFT送信","JOBNET","Server:/新基幹_本番処理/MCS/監視/09_注文送信未更新項目チェック","AJSROOT1:/新基幹_本番処理/MCS/監視/09_注文送信未更新項目チェック/EDI送信情報リスト_HULFT送信","END","20210901225446","20210901225446","0"   Please help in resolving this. ... View more

Hello all,   I am trying to extract the below highlighted fields, but the extractions at time is failing to get the required values, can you please help me get this working. 1) 537654 High 2021.11.10 10:53:50 RDS_Failure_notification01 prd-Server2 127.0.0.1 sns.event EventSource : db-instance IdentifierLink : https://console.aws.amazon.com SourceId : prd-Server2 EventId : http://docs.aws.amazon.com EventMessage : DB instance restarted TopicArn : arn:aws:sns:ap-northeast-1:123456789:Lambda-PRD-Server1-SSS 2) 536465 High 2021.11.09 23:07:33 Server just booted [prd-Server1] prd-Server1 127.0.0.1 Server Status 00:04:44 3) 536438 High 2021.11.09 23:01:02 App Proxy: Utilization of unreachable poller processes over 80% prd-Server3 127.0.0.1 Utilization of unreachable poller data collector processes, in % 100 % 4) 448232 Average 2021.11.09 09:56:02 App Proxy: Utilization of unreachable poller processes over 70% prd-Server4 127.0.0.1 Utilization of unreachable poller data collector processes, in % 100 %   BOLD - Field1 Underlined -Field2 Strikethrough - Field3   @ITWhisperer @javiergn @richgalloway  Please have a look at this.   Thank you ... View more

Hello all, I have a saved search that I want to run once every Sunday at 00:00. I have added in the query to pick the events for the last 7 days as: earliest=-7d@d latest=@m. I have also scheduled it to run every week on Sunday at 00:00 and time range as Last 7 Days.   When I run the saved search manually it is working as expected and also when I run this by changing the schedule to run every 5 mins for last 7 days range it is able to index the data. However, when I schedule it to run once every week, even though the search is running the data is not being indexed to tier3. When I checked the job manager, the run was successfully completed but no data was pushed to tier3.   Can you please help on this. ... View more

Hello team,   I am trying to monitor windows event logs and have installed the universal forwarded with relevant data. I am getting the Application and System logs, however the Security events are not being forwarded. I am adding the inputs.conf details below please let me know what is causing this.   ###### OS Logs ###### [WinEventLog://Application] disabled = 0 start_from = oldest current_only = 0 checkpointInterval = 5 # only index events with these event IDs. whitelist = 16350-16400 index = default_tier1_idx renderXml=false [WinEventLog://Security] disabled = 0 start_from = oldest current_only = 0 checkpointInterval = 5 # only index events with these event IDs. whitelist = 0-10000 index = default_tier1_idx renderXml=false [WinEventLog://System] disabled = 0 start_from = oldest current_only = 0 checkpointInterval = 5 # only index events with these event IDs. whitelist = 7000-7050 index = default_tier1_idx renderXml=false   Thank you ... View more

Hello team,   I am trying to extract the below highlighted fields. However when I use the expression this is working right on one type of event but picking a different(underlined) field from other event. Please let me know what wrong I am doing here.   (?:[^,]+,){19}\"(?<instance>[^,]+)\",.* Below is the event which is getting extracted as expected. 50271232,00004102,00000000,1600,"20210901225500","20210901225500",4,-1,-1,"SYSTEM","","psd217",46769357,"MS932","KAVS0260-I \x83W\x83\x87\x83u\x83l\x83b\x83g(AJSROOT1:/\x90V\x8A_\x96{\x94ԏ\x88\x97\x9D/\x92l\x8ED\x94\xAD\x8Ds/04_\x92l\x8ED\x8Ew\x8E\xA6\x83f\x81[\x83^\x98A\x8Cg_\x8CߑO1TAX:@5V689)\x82\xF0\x8AJ\x8En\x82\xB5\x82܂\xB7","Information","jp1admin","/APP/ABC/AJS2","JOBNET","Server2:/\x90V\x8A_\x96{\x94ԏ\x88\x97\x9D/\x92l\x8ED\x94\xAD\x8Ds/04_\x92l\x8ED\x8Ew\x8E\xA6\x83f\x81[\x83^\x98A\x8Cg_\x8CߑO1TAX","JOBNET","AJSROOT1:/\x90V\x8A_\x96{\x94ԏ\x88\x97\x9D/\x92l\x8ED\x94\xAD\x8Ds/04_\x92l\x8ED\x8Ew\x8E\xA6\x83f\x81[\x83^\x98A\x8Cg_\x8CߑO1TAX","AJSROOT1:/\x90V\x8A_\x96{\x94ԏ\x     Below highlighted is what I need to extract but the underlined is getting extracted. 50271228,00004105,00000000,3088,"20210901225446","20210901225446",4,-1,-1,"SYSTEM","","psd240",316413752,"MS932","KAVS0263-I \x83W\x83\x87\x83u(AJSROOT1:/\x90V\x8A_\x96{\x94ԏ\x88\x97\x9D/MCS/\x8AĎ\x8B/09_\x92\x8D\x95\xB6\x91\x97\x90M\x96\xA2\x8DX\x90V\x8D\x80\x96ڃ`\x83F\x83b\x83N/HULFT\x91\x97\x90M\x8C㎞\x8Aԑҋ@1MIN:@50R6189)\x82\xF0\x8AJ\x8En\x82\xB5\x82܂\xB7(host: PSD511, JOBID: 0)","Information","jp1admin","/App/ABC/AJS2","JOB","Server1:/\x90V\x8A_\x96{\x94ԏ\x88\x97\x9D/MCS/\x8AĎ\x8B/09_\x92\x8D\x95\xB6\x91\x97\x90M\x96\xA2\x8DX\x90V\x8D\x80\x96ڃ`\x83F\x83b\x83N/HULFT\x91\x97\x90M\x8C㎞\x8Aԑҋ@1MIN","JOBNET","AJSROOT1:/\x90V\x8A_\x96{\x94ԏ\x88\x97\x9D/MCS/\x8AĎ\x8B/09_\x92\x8D\x95\xB6\x91\x97\x90M\x96\xA2\x8DX\x90V\x8D\x80\x96ڃ`\x83F\x83b\x83N","AJSROOT1:/\x90V\x8A_\x96{\x94ԏ\x88\x97\x9D/MCS/\x8AĎ\x8B/09_\x92\x8D\x95\xB6\x91\x97\x90M\x96\xA2\x8DX\x90V\x8D\x80\x96ڃ`\x83F\x83b\x83N/HULFT\ ... View more