Hi Steve,
Sorry for the delayed response. It did not work. Here is the relevant info from props.conf, outputs.conf, & transforms.conf file.
props.conf entry
[IT-LDAP-audit_entry]
TIME_PREFIX = ^AuditV3--
TIME_FORMAT = %Y-%m-%d-%H:%M:%S
TZ = US/Eastern
BREAK_ONLY_BEFORE = ^AuditV3--
TRANSFORMS-routing = arcsightldapnp
Transforms.conf entry
[arcsightldapnp]
REGEX = .
DEST_KEY = _TCP_ROUTING
FORMAT = arcsightldapnpreader
Outputs.conf
[tcpout:arcsightldapnpreader]
disabled = false
server = servername:1536
Thanks in advance for your help
Murali
... View more