abc and xyz events are mixed up in pqr (where pqr is sourcetype)

[Praz_123]

Hi ,

We are getting the mixed abc and xyz events from sourcetype pqr. Due to this, Network team are getting multiple false tickets . 

[gcusello]

Hi @Praz_123,

your question is just a little vague!

could you share more details?

which is the sourcetype?

are you using a standard or a ustom Add-On?

Anyway, using a simple search analyze your data to understand which hosts are involved and what's te Add-On that you have to correct, probably you need only to specify the sourcetype in the inputs.conf.

Ciao.

Giuseppe

[Praz_123]

@gcusello 

only yesterday we had received like mixed event like:

abc and xyz are coming in a same events

Previously it didn't happen like that  

[gcusello]

Hi @Praz_123 ,

as @ITWhisperer asked: did you changed something in your configurations?

I repeat my questions:

are you using a custom sourcetype and add-on?

if not which one?

Ciao.

Giuseppe

[ITWhisperer]

It sounds like something recently changed - either change it back or change forward to fix it