Help with props.conf

daniel333 — Tue, 29 Sep 2020 22:03:11 GMT

all,

I was able to get the results I wanted in my search but I need to convert this into a props.conf config file.

vendor=f5 sourcetype=linux_messages_syslog | head 1
| rex field=_raw "dest_dvc=(?.*) jira="
| makemv dest_dvc
| rex mode=sed field=dest_dvc "s/,//g"

How do I get makemv and that sed into props.conf?

thanks
-Daniel

Re: Help with props.conf

FrankVl — Wed, 14 Nov 2018 08:50:07 GMT

Can you please post your search code as code using the 101010 button in the editor? Otherwise some special characters might get lost, causing people to misunderstand your regexes for example.

Also: some sample data and desired output might help understand what you are trying to do.

In general: SEDCMD in props.conf works on the raw data at indextime, so you cannot use it in a similar way as you are doing here. Hence: please provide sample data and show what the desired output should be, then we can certainly help you come up with some props.conf code that does the same.

topic Re: Help with props.conf in Getting Data In

Help with props.conf

Re: Help with props.conf