Administration Guide › Mapping and Parsing › How to Create a Message Parsing File › Load Sample Events

Load Sample Events

You can provide sample events to use in testing the new XMP file by searching through the event log store or by accessing a log file. Sample events provide a template against which you can test the parsing file as you construct it in the other wizard steps. You can also use sample events to test the parsing output in the final step of the wizard.

To provide sample events

1. Open the parsing file wizard and advance to the Load Events step.

   The Load Events screen appears.

2. Select the Log Store or Log File radio button in the Find Sample Events area.
   • If you select Log Store:
     1. Select the sample event source type you want from the Parsing Column drop-down menu. Choose result_string for WMI event sources, or raw_event for syslog event sources.
     2. Select the query you want to use to provide sample events using the Query Tag Filter and Query List.

     The query appears, displaying sample events you can use to test parsing as you advance through the wizard.

     Note: You can use any available or custom query to locate sample events. If you plan to use a custom query, we recommend that you create and test it before beginning the message parsing file design process. We recommend using a sample event file with less than 1500 events for ease of analysis.

   • If you select Log File, browse to find the log file you want, and click Upload.

     Events from the log file appear in the Sample Events pane. You can use the events to test parsing as you advance through the wizard.

     Note: The wizard assumes that each line in the file is an event. Multiple line events are not supported.

3. Click the appropriate arrow to advance to the wizard step you want to complete next.

   If you click Save and Close, the new file appears in the Parsing File User folder, otherwise the step you choose appears.