I am attempting to black hole some data. It is based off simple strings, but my regex is not working.  1st. I want to remove all events that contain "somename@google.com" props: sourcetype=ipstuff [ipstuff] TRANSFORMS-filter-events = ipstuff_drop_event Transforms:  [ipstuff_drop_event] REGEX = somename\@\google\.\com DEST_KEY = queue FORMAT = nullQueue 2nd. I want to remove all event that contain the string "totalamountsystem". props: sourcetype=ds:fip [ds:fip] TRANSFORMS-filter-events=totalamountsystemDrop Transforms: [totalamountsystemDrop] REGEX = totalamountsystem DEST_KEY = queue FORMAT = nullQueue   What am I missing here?   ... View more

Auditing - When multiple functions of adding and removing a role, only the adding of the role is audited. How do I fix? ... View more

Can you extract only the components you need from ES and push them out as seperate app for UBA to work? ... View more

Is it possible to have two instances of ES searching the same search peer pool? ... View more

So our main index is our actual index and index_archive is the virtual index that is querying hadoop. When I query only the main index, we get results, but none from our virtual index. index=main OR index=main_archive user=exampleuser | search (NOT "exampleExlude" NOT oauth_client_name=example-productionname ) | where isnotnull(ip_forwarded_for) | eval source= mvindex(fwd_list, 0) | eval fwd_list = split(ip_forwarded_for, ",") | table _time, user, source, authorization_description, authorization_success, user_agent, method, path | sort _time asc ... View more

We are going through some compliance stuff and I need to ensure that our data integrity is true. How would I go about doing this on a virtual index? We are using hadoop to read the data from s3 in AWS. ... View more