All,
I need to monitor the /etc/resolv as sourcetype config_file in my env. This is well below the 256 byte min for CRC I am sure.
Larger files are working fine, but this is pretty small, 3 lines. It's coming in as hosts_too_small. I clearly have sourcetype set correct in inputs.conf and even tried setting it again with a tranform. But still comes in as "too small".
Any idea how I can get this file correctly indexed as sourcetype config_file?
Just did this, and it worked. Seems like I am solving this wrong.
props.conf:
[(?::){0}*-too_small]
TRANSFORMS-remove_too_small = remove_too_small
transforms.conf:
[remove_too_small]
SOURCE_KEY = MetaData:Sourcetype
DEST_KEY = MetaData:Sourcetype
REGEX = sourcetype::(.*)-too_small
FORMAT = sourcetype::config_file