Help with props.conf

[daniel333]

all,

I was able to get the results I wanted in my search but I need to convert this into a props.conf config file.

vendor=f5 sourcetype=linux_messages_syslog | head 1
| rex field=_raw "dest_dvc=(?.*) jira="
| makemv dest_dvc
| rex mode=sed field=dest_dvc "s/,//g"

How do I get makemv and that sed into props.conf?

thanks
-Daniel

[FrankVl]

Can you please post your search code as code using the 101010 button in the editor? Otherwise some special characters might get lost, causing people to misunderstand your regexes for example.

Also: some sample data and desired output might help understand what you are trying to do.

In general: SEDCMD in props.conf works on the raw data at indextime, so you cannot use it in a similar way as you are doing here. Hence: please provide sample data and show what the desired output should be, then we can certainly help you come up with some props.conf code that does the same.