Forum Discussion

FahadAhmed's avatar
FahadAhmed
Brass Contributor
Aug 28, 2023

Table based transformation not working when onboarding systems through AMA agent

Hi, We initially had a few servers with MMA agent deployed, we performed transformation on "SecurityEvent" table to drop unwanted event IDs. Now when we are installing AMA agent on the same machines...
data collection
BillClarksonAntill's avatar
BillClarksonAntill
Iron Contributor
Before i answer the above, i need to know if you waited 1 hour after you applied the transformation against the table / DCR rule

There is a delay at the API level which can make you think its not working
FahadAhmed's avatar
FahadAhmed
Brass Contributor
Sep 19, 2023

Thanks for the guidance bill, I have figured out the answer.  Table based transformations donot apply for AMA based log ingestions, we will need DCR. Performed DCR based transformation and its working fine.

Thanks

Resources