This website uses Cookies. Click Accept to agree to our website's cookie use as described in our Privacy Policy. Click Preferences to customize your cookie settings.
I have created a custom parser for json raw data for proofpoint. I
tested my parser and was able to get all required fields in UDM
output.Let say, I ingested some sample raw data around 32 via s3. There
were 2 logs with incorrect json data and 30 wit...
yes surprisingly it appeared after 24hr of ingestion.Observation:1. If
the timestamp of the indexed event is backdated to far date (in my case
over 2 weeks) then it does not show the parsed log within 3-4hr of
checking (unparsed appears immediately w...
