Hello, I have a CSV file that has 21 fields, I need to remove fields 1,2 & 15 from the CSV file as this contains sensitive information. The list is comma separated but I can't work out how to remove these at index time. I have the option to remove or mask but the value in each field is of different length. Can anyone help with the props & transforms required for this please. Regards Rob ... View more

Hi, Anyone who has used the Incapsula API script that is available from "https://github.com/Incapsula/logs-downloader" Have you had any issues getting it running, i'm not able to execute the script. I've followed the instructions, installed the required packages but still no luck. I've validated that the default directories are there and accessible. Traceback (most recent call last): File "/incapsula_download/script/LogsDownloader.py", line 586, in logsDownloader = LogsDownloader(path_to_config_folder, path_to_system_logs_folder, system_logs_level) File "/incapsula_download/script/LogsDownloader.py", line 109, in init os.makedirs(self.config.PROCESS_DIR) File "/usr/lib64/python2.6/os.py", line 157, in makedirs mkdir(name, mode) OSError: [Errno 2] No such file or directory: '' Any help would be great. Regards Rob ... View more

I currently have a feed that indexes fine, however within the message there are various other timestamps that I'd like to use to create visualizations etc. How can I use these to for the visualization and ignore the _time value? LAST_SCAN_DATETIME is the field picked for _time, which is the best fit indexing. Other fields are below that I want to use in search/visualizations - FIRST_FOUND_DATETIME LAST_FOUND_DATETIME LAST_TEST_DATETIME LAST_UPDATE_DATETIME all appear in this format: 2017-05-23T12:20:33Z YYYY-MM-DDTHH:MM:SSZ Regards Rob ... View more

I have a mixture of Wintel and *nix hosts that send logs via the UF, the UF is deployed globally by third parties so access once deployed is limited and standards vary globally in terms of hostname. All hosts start is a letter thats about it. The question I have is that reporting is being a challenge and I want all hosts to be consistent in terms of name convention, i.e. without any fqdn name. For Wintel and 70% of *nix this is not a problem and host appears as the shortname. However for the other 30% the fqdn name is an issue. I've looked but can't find the answer or a solution that works. My theory is props/transforms config on the HF's that target the sourcetype of the hosts with the fqdn. Can someone help me out please? As this is global and not standardized there are multiple variations on fdqn. Goal - Index host as shortname Variations on fqdn could be anything along the lines - host.xxx.com host.xxx.xx.xxx.corp host.xxx.xxx.com host.xxx.xxx.ie I tried to work out a searchtime transform but couldn't get it to capture both shortname and fqdn names into one field. This would also be a valid option over the index time. Regards Rob ... View more