Hi, The file was placed in a monitored folder from the HF (so through inputs.conf), but even when we tested uploading it via the GUI -like we tested in the dev environment- it still wasn't parsed For the sourcetype, it was a custom one: [Sourcetype_1] BREAK_ONLY_BEFORE_DATE = CHARSET = UTF-8 DATETIME_CONFIG = EVAL-CREATION_DATE = EVAL-DEPT = EVAL-FIRST_NAME = EVAL-FONCTION = EVAL-FULL_NAME = if(match(Name, "(Disabled)"), substr(Name, 1, len(Name)-11), Name) EVAL-LAST_LOGON = replace(Last_Seen, "(\d+)\.(\d+)\.(\d+)", "\3.\2.\1") EVAL-LAST_NAME = EVAL-LOCKED = if(match(Name, "(Disabled)"), "Yes", "No") EVAL-LOCK_REASON = EVAL-LOGIN = Name EVAL-MAIL = Email EVAL-METROID = EVAL-PROFILE = Roles."|".Scope."|".Groups EVAL-PWD_VALID_TO = EVAL-STORE_CODE_5digits = EVAL-USER_IDENTIFICATION = "1 Firstname 1 Name" EVAL-VALID_FROM = EVAL-VALID_TO = EXTRACT-DATE_EXTRACTION = (?i)^.+_(?P<DATE_EXTRACTION>\d{8})\.csv in source EXTRACT-Name,Email,Scope,Last_Seen = EXTRACT-username,type,firstname,lastname,email = LINE_BREAKER = ([\r\n]+) NO_BINARY_CHECK = true SHOULD_LINEMERGE = false category = Custom disabled = false pulldown_type = 1 EXTRACT-Name,Roles,Email,Groups,Language,Agent_Type,Scope,Last_Seen = ^(?<Name>[^;]*);(?<Roles>[^;]*);(?<Email>[^;]*);(?<Groups>[^;]*);(?<Language>[^;]*);(?<Agent_Type>[^;]*);(?<Scope>[^;]*);(?<Last_Seen>[^;]*) #MAX_TIMESTAMP_LOOKAHEAD = 1000 #HEADER_FIELD_LINE_NUMBER = 1 I know the sourcetype isn't clean or anything but why would he work on standalone, and not in distributed environment ?
... View more
