Hi guys, I decided to create this post to get some help from this community.
We have a problem in our lab environment since we did the upgrade to 11.5.3 version.
When the log decoder receive some logs and I want see them in the Investigate -> Events View, in the event "META ABOUT" column, the meta values from the raw log that it was selected are erroneous. These meta values correspond to another previous log. The meta values don´t match to the log.
For example, here we have 9 logs about Windows host with the reference id 4625 that is a login failed.
If we select one of these logs, we shold see the metakey user.dst that appears there.
If a select the Log whit the Account Name is administrator5, the meta values that appears are wrong:
In the Event Meta column it shows the meta keys of the previous registry that corresponds to a registry/LOG with the account name equal to administrator4.
This happens with any log you select in the Events view. The Event Meta column always shows the values from a log prior to the one you select.
We restart all services but it does not work.
Any suggestions or solutions?
Thanks
