extract field from MetaData:Source

schose — Mon, 22 Jun 2015 12:36:03 GMT

Hi all,

I'm trying to extract the field "vservice" from Source as the last two characters (after _) from sourcetype "catalina".

props.conf

[catalina]
REPORT-vservice=vservice

transforms.conf

[vservice]
REGEX=_(\w\w)$
FORMAT=vservice::$1
SOURCE_KEY=MetaData:Source

I don't see why it's not working... 😞

index="myindex" | rex field=source _(?<vservice>\w\w)$

which should be the same is working fine for me.

Regards,

Andreas

Re: extract field from MetaData:Source

schose — Mon, 28 Sep 2020 20:17:53 GMT

hi,

placing

SOURCE_KEY=MetaData:Source with
SOURCE_KEY=source

in transforms.conf seems to work.

Regards,

Andreas