Hi,I've below log lines in below
format:
1) D:\SystemX\XManager\TEST1_XM_5_1_0_361\Director\GenericService.log
2) D:\SystemX\XTrader\TEST1_XM_5_1_0_361\Director\GenericService.log
3) D:\SystemX\XInterface\TEST1_XM_5_1_0_361\Director\GenericService.log
How can I get the logs under D:\SystemX\......
I have created field extract filter to seperate XManager, XTrader and Xinterface and I want to view logs in a way that if I select XManager I will see all logs under D:\SystemX\XManager\..
and so on.
The regex i was trying : ^\w+\:\\SystemX\\(?<app>[A-Za-z]*)
But it showing error.
I really appreciate your help.
Thanks
Nik,
I'm curious why you're not just sourcetyping these...ie:
In props.conf.
[source::.../XManager/.../GenericService.log]
sourcetype = XManager
[source::.../XTrader/.../GenericService.log]
sourcetype = XTrader
[source::.../XInterface/.../GenericService.log]
sourcetype = XInterface
That way, when you search on them you just type:
sourcetype = XManager <rest of your search>
You will get all of the files (regardless of which version they are) that have XManager in the directory structure and end with the filename of GenericService.log.
Hope that helps.
Try switching from slashes to backslashes. Remember the backslashes need to be escaped, i.e. \\
. (Or, setup a rule that allow for both unix and windows separators using something like this: [source::...[/\\]XInterface[/\\]...[/\\]GenericService.log]
. It looks funny, but it should work.
Thanks for suggestion. I should have think this before. I tried the above changes in prop.conf but its not working.
1) I am looking log files from windows machine so I changed the forward slash to backward.
[source::...\XManager\...\GenericService.log]
sourcetype=XManager
Exact location:
D:\SystemX\XManager\TEST1_XM_5_1_0_366\Director\GenericService\Logs\SystemX\GenericService.log
I just have to make the changes under deployment server not on the indexer right?
Please let me correct if I am wrong.
thanks, Nik