I want to add a Field Extractor Regex in props.conf but not from _raw but from another field
Example: rex Filed=test "(<BLA>\w+\w+)
" I want to add this to props.conf but it thinks its extracting it from _raw and I want it to be extracted from test
How cant his be done?
This can be done by using the SOURCE_KEY option in the transforms.conf. So, in props.conf
[mysourcetype]
REPORT-myextract = myextract
Then in transforms.conf:
[myextract]
SOURCE_KEY = test
REGEX = (
Dave
This can be done by using the SOURCE_KEY option in the transforms.conf. So, in props.conf
[mysourcetype]
REPORT-myextract = myextract
Then in transforms.conf:
[myextract]
SOURCE_KEY = test
REGEX = (
Dave
Spot On! Thanks mate