Hi Rich,
I was able to understand the regex except the point where we added [^\] after name capturing. The other character '\' after First could be understood to be escaped properly but why [^\]
Thanks !
... View more
If you need to define this hourly then you can do something like this
index=xyz OR index=lmn OR index=abc earliest=-2h@h latest=-1h@h NOT [search index=xyz OR index=lmn OR index=abc earliest=-1h@h latest=now | table index] | table index
... View more
To ensure that you don't get any license violations, monitor your license usage and make sure your license volume is sufficient to support your operational usage. If you do not have sufficient license volume you need to either increase your license or can also go for tweaking your indexing volume.
... View more