Shoud it be done in the props.conf stanza at the moment of indexing?
I'm gonna have multiple .txt files indexed and later for a dashboard I need to get these filename to compare each other's values.
Is there a way to create a new field using eval for these filenames?
Thanks in advance!
- Vinicius Guerrero
The filename should show up in the source
field, right? Why not just use it from there?
The filename should show up in the source
field, right? Why not just use it from there?
But will I be able to table it as a result? Is there any example on how to use it?
It's a field like any other field you might have. You can include it in a table ( table source field1 field2...
), you can use it to group your results ( stats sum(field1) by source
), you can create another field by applying a regex to it ( rex field=source "regex-goes-here"
). Anything you can do with a text field you can do with source
.
Thanks @awitzman ! it worked!
I thought it wouldn't work for multiple files, but seems ok without a regex.