Re: How to tell if you are setup to use raw logs in LEM

https://support.solarwinds.com/Success_Center/Log_Event_Manager_(LEM)/LEM_Administrator_Guide/0970-Search_raw_log_messages_using_nDepth_search?CMPSource=THW&CMP=DIRECT

I do not have the option for "On the far right of the search bar, move the switch from Events to Log Messages"

To bad there is not a pic of it to verify lol

https://support.solarwinds.com/Success_Center/Log_Event_Manager_(LEM)/LEM_Administrator_Guide/0160-Configure_LEM_to_store_original_log_messages_nDepth_log_retention?CMPSource=THW&CMP=DIRECT#Configure_connectors_to_send_original_log_data_to_LEM

Alert: Sending data to the alert database> they show only alert

https://support.solarwinds.com/Success_Center/Log_Event_Manager_(LEM)/LEM_Administrator_Guide/0160-Configure_LEM_to_store_original_log_messages_nDepth_log_retention?CMPSource=THW&CMP=DIRECT

Rules do not fire on raw (non-normalized) log data. Rules can only fire on normalized data, I see rules firing off

Raw (non-normalized) log messages do not appear in Monitor view in the Console, can not tell on this one