Actually...I found it.......Source was capitalized and in the regular search it is not. I see that this is extremely case sensitive
Thanks TP On Friday, January 20, 2017 at 3:44:54 PM UTC-6, Tom Powers wrote: > > Hello Everyone!! > > Total Noob to Graylog...but I have read the docs and have scoured the net > for this. > > Brand new Graylog2.1 from OVA. > > Sending data into it from windows event logs via nxlog > > Everything works great...I can get searches on ExventIDs, create streams > and dashboards. > > here's the question: > > If I do a simple search from the main screen like > source:tp2015.ssi.private I get all the messages from the node with > that name. > > If I go to make a stream for this...and select the source match > exactly tp2015.ssi.private as the only rule....I get nothing > > What am I missing or not understanding here? > > All insight is appreciated > > Thanks > > TP > -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to graylog2+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/99bc4e61-70cc-4e39-8081-fbea15f5208e%40googlegroups.com. For more options, visit https://groups.google.com/d/optout.
