It's sad... I was trying to implement some RegEx to break the content down by host/sourcetype...
I had to clean the eventdata a couple of times...
And now guess what? Licence violation! I feel like a bad boy!
Ok... Maybe I should have played with smaller logs files...
Maybe when you do a clean eventdata it should take in consideration that you will need to reindex everything...
I just read that we cannot reset a free licence. What can I do a this point? I cannot upgrade to a commercial license yet. I'm not convinced that it will be useful in my day to day tasks.
Any tips, comments, shame on me?
Thanks,
-P
... View more