Why does my EventClassInstance not match an event?
When doing even mapping the eventClassKey must match the name of the EventClassInstance. Open the event (which I’m guessing has a class of /Unknown) and look at its eventClassKey. make the name of your EventClassInstance the same. If you need to be more specific then add the regex (i.e. there will be more than one mapping with the same name). If you want to process all events with a EventClassInstance name it defaultmapping and it will be run if no other EventClassInstance match. You can sequence mappings with the same name in the sequence tab of a mapping. The eventClassKey is often the name of a process (it’s what is called the tag of a syslog message).
