Custom property disabled

Explanation

A custom property expression is disabled because the custom property expression has performance problems. Rules, reports, or searches that use this property, and which rely on the disabled expression to populate it, stop working properly.

The RegexMonitor feature monitors custom properties and disables any expressions that take longer than two seconds to parse. If inefficient custom property expressions are not disabled, the parsing queue overflows, and some events bypass parsing and do not normalize. Any searches, rules, or reports that rely on the non-normalized events do not function properly. When inefficient custom property expressions are disabled, parsing functions properly, and all events normalize. Only those searches, rules, and reports that rely on the custom property that is populated by the disabled expression do not function properly.

User response

Select one of the following options:

• Review the disabled custom property to correct your regex patterns. Do not re-enable disabled custom properties without first reviewing and optimizing the regex pattern or calculation.
• If the custom property is used for custom rules or reports, ensure that the Optimize parsing for rules, reports, and searches check box is selected.