Hello
i have a log event as
DEBUG 2017.02.06 17:15:35.385: (common.work) Parsed source address, source='10.0.0.2' i want to change the source as src_ip at index time
can any one help me ?
Thanks in advance
Try like this (props.conf on Indexer/heavy forwarder)
[YourSourceType]
...other settings..
SEDCMD-srcip = s/,\s+source=/, src_ip=/g
SEDCMD-source = s/, source=/, src_ip=/
Although I think a better option is to use a field alias. Settings -> Fields -> Field aliases
Try like this (props.conf on Indexer/heavy forwarder)
[YourSourceType]
...other settings..
SEDCMD-srcip = s/,\s+source=/, src_ip=/g