Hi all
I have an addon plugin that utilizes REST API to obtain specific logs; each generated event has fixed values for both source and sourcetype.
Now there are customers who use props.conf and transforms.conf that will change the value of the source according to a particular column within an event; for instance, if the service is 'a', then the source changes to 'service_a'; if service is 'b' then it changes to 'service_b'.
The current problem is that obtaining logs works fine, and content can always be found using sourcetype. But when using transformed source to search, events cannot be found even though events with 'service_a' and 'service_b' are visible.
How should I adjust the addon or how should I configure local settings so that I can search using source?
Regards
Emily
