I have a Prop & Transform file. In it, I'm trying to parse a specific field and label it as a source type. I had it working before but now... it's a bit broken.
Transforms.conf
[audit_sourcetype_11]
REGEX = (AUDIT_Sourcetype_1)
FORMAT = sourcetype::Sourcetype_1_Name
DEST_KEY = MetaData:Sourcetype
[audit_sourcetype_22]
REGEX = (AUDIT_Sourcetype_22)
FORMAT = sourcetype::Sourcetype_2_Name
DEST_KEY = MetaData:Sourcetype
Props.conf
disabled = false
NO_BINARY_CHECK = true
disabled = false
pulldown_type = true
The other issue I'm having is that I have certain events and messages that show up like this:
[ System_Message = This is a system message ]
However Splunk parses it and displays it like this:
Field: System_Message
Value: This
How do I tell Splunk to look at the entire message. Not just the first character? In the same Transforms.conf?
It is not a configuration file of the field definition.
If the field definition is bad, why not try redefining it from the GUI?