Hi
I have a list of event sources that was added to the system a long time ago, some event sources don't have IP addresses and others have an outdated IP. What should I do in this case? can I edit these record? or I have to add a new event source with the updated information and delete the old one?
Thank you.
where are you looking in the product to see this information? are you in investigation looking at old meta? are you in the event sources page or somewhere else that you see what you are looking to change? provide a screenshot if you can.
no, I'm in the administration module, in the manage tab, same as shown in on the picture.
let's say that we have updated the IP address of the first event source to a new IP address, can I edit the information of that event source from this menu?
No, you cannot edit the IP address in this screen. The best thing to do is delete the incorrect entry (based on IP address).
This view is filled up from current logs, so your new device will show here once it starts to log. You can remove the old device address from that screen to keep the entries current.
Removing from this screen does not affect your stored logs, so cleaning up this screen only affects what this screen and the policies in the other tab work on.
Thank you.
No, you cannot edit the IP address in this screen. The best thing to do is delete the incorrect entry (based on IP address).
This view is filled up from current logs, so your new device will show here once it starts to log. You can remove the old device address from that screen to keep the entries current.
Removing from this screen does not affect your stored logs, so cleaning up this screen only affects what this screen and the policies in the other tab work on.