Forum Discussion

MiteshAgrawal's avatar
MiteshAgrawal
Brass Contributor
Feb 04, 2020
Solved

Not getting logs from Custom Log source

Hi Team,   I created a txt file and called it in the Custom log. The txt file contains only 5 IPs separated by new line. I am not getting those 5 IPs in RawData for that Custom log.    Do we nee...
  • CliveWatson's avatar
    CliveWatson
    Feb 05, 2020

    MiteshAgrawal 

     

    1. 1st check, does your machine that contains the log file have a working MMA on it?  You have data from that computer in the Heartbeat table?

    2.  In Log Analytics the table shows up in the Schema?   I think the answer is no?

    <name you used>_CL

     

    e.g.

     
    custom_CL
| limit 10
     
     

    If the MMA isn't talking to Azure then its likely there is a network issue (often a proxy). Instructions will vary by product and setup to resolve this.  Can you put the file on a server that is working?

     
     

     

     

     

MiteshAgrawal's avatar
MiteshAgrawal
Brass Contributor
Feb 06, 2020

Hi CliveWatson GaryBushey ,

 

Thanks a tonne for your help.

 

I was having issue with the MMA and I resolved it and as you mentioned, I started receiving heartbeat from my system.

 

Also, in sometime I got the Custom Logs as well.

 

Without your help this might not be possible. I have been using Azure only from past couple of days and was able to do this only because of your help. Thank you and the community.

 

I have three more requirements. I have received the IPs in the RawData under Custom Log source table name.

 

1. I want to save those IPs in some list or table permanently which I can call in rules. How can I achieve this?

 

2. I used BLOB storage and uploaded a txt file over there with IPs. Called them in the query using externaldata operator. This is successful. But again I want to use these IPs against rules and so want to save these IPs in some list. And what if I delete the blob object, if I do not create a list then we cannot reference the data via externaldata operator right?

 

3. How can I change the time of querying the file read for Custom Log collection? I want to read the logs from the file in every 1 hours (for example)?

 

Please find the necessary screenshots attached in order to understand my requirement correctly.

 

Regards,

Mitesh Agrawal

pooja1208's avatar
pooja1208
Copper Contributor
Sep 20, 2022

Hi MiteshAgrawal 

I am facing the same issue for exacting custom logs .tried to setup MMA but getting issue for configuring the same like Invalid configuration . I am uploading log file from my local machine.
Is there anything I'm missing .
TIA

Resources