I want to offload events with specific verbiage in them. I’m looking for events where the text contains “bsci_GetAvailableSoftwarePackagesEvent’” - an event we write to the audit log.
Error messages / full error message screenshot / log file:
No error message; nothing gets offloaded
Question related to a free trial, or to a production (customer) instance?
I found that I was looking at text when I should have been looking at type. When I chanced the filter predicate to type=‘bsci_GetAvailableSoftwarePackagesEvent’, that created the offload I was looking for.