EVENTSESH;0;01/03/2018 22:57:27:5000;1;1;0;;;END OF IMPORT PROCESS FOR THE MASTER STORE - PENDINGTXT(0)
after this line I want to ignore all the lines before indexing from the log files. Please suggest me how can i do this with the help of sedcmd command. I am using universal forwarder.
Please also tell me the exact path where I have to make changes for props.conf. I'm using windows OS
forgot to mention my source name (source: D:\CentralData\MONACO)
This answer might help you.
This basically black-holes data that meets a specific regex. Of course, if the lines are not uniform this will be difficult.