Sample Data:
FILED1|FIELD2|FIELD3|FIELD4
INDIA|AGRICULTURE|HELLO|200
AMERICA|FOOD|HELLO |404
CHINA|PEOPLE|HI|402
NEPAL|COLTHS|HI|411
Output should have only have only field FIELD2 & FIELD3 data.
Inputs.conf
[monitor://C:\testauths*.txt]
index=main
sourcetype=mytestdata
props.conf
[mytestdata]
CHARSET=AUTO
DATETIME_CONFIG=CURRENT
INDEXED_EXTRACTIONS=csv
SHOULD_LINEMERGE=false
disabled=false
pulldown_type=true
FIELD_DELIMITER=|
HEADER_FIELD_LINE_NUMBER=0
REPORT-fields = getLogData
transforms.conf
[getLogData]
DELIMS = "|"
FIELDS= "",FIELD2,FIELD3,""
I am sure somewhere i am making mistake.
... View more