Well, one thing to try is to use rex to extract the name as a field. If this works fine, you can then make it permanent by making the changes in props.conf (or via IFX).
Consider these sample events;
"The quick brown fox-db jumps over the lazy dog"
"All work and no play makes Jack a dull boydb"
"Crane-db, the most powerful tool at the building site"
To extract the database-strings from these type of events, you might try;
...| rex "(?<my_db>\S+db)" | table my_db
and the output would be;
my_db
-----
fox-db
boydb
Crane-db
Please provide a few sample events if you want more qualified advice.
... View more