Anybody can answer to simple question?
How to remove from indexing host= d:\TEST.log just "<TD>" combination?
What should be in props.conf and what should be in transforms.conf ?
No one example from your answers is not working for me.
Untested:
props.conf
[host::yourhost]
SEDCMD-removetd = s/<TD>//g
You may or may not need to escape the angle brackets with backslashes. Also, check if your host really is called d:\TEST.log
because that looks awfully similar to a source value instead.
Great. Don't forget to mark this as solved.
It works!