Hi!
I have some different sourcetypes defined by me where I'm extracting some of the fields with stanzas in transforms.conf at search time (I'm using REPORT in props.conf). Here is one example of a stanza I'm using:
REGEX=(?im)[\r\n]+([^\r\n]*name)\: ([^\r\n]+)
FORMAT=$1::$2
MV_ADD=true
This extracts the fields I want, but since I extract the field name like this, the field name may be in uppercase, lowercase or a combination.
Creating new stanzas for each field is not an option since I have a lot of fields and most of my stanzas are of the form shown above, where I just define the ending of the field name, to be able to extract most of them.
I wonder if there is any way to "force" the field names to lowercase?
