Windows eventlog are indexed fine.
A particulare evnetlog source "WinEventLog:Application Info" (mind the space) contains the normale message field.
Inside this message field I want to extra a hostname.
sourcetype="WinEventLog:Application Info" | rex field=Message "regex query"(?....) more regex" works all fine. Hostname are captured.
Now I really need this to be done from the props.conf.
I created in the props.conf
["WinEventLog:Application Info"]
EXTRACT-Hostname = same regex as above
But this doesn't seem to work? I'm I missing something?
Something wrong with the sourcetype name (mind the space)?
