Is there a way to use some sort of regular expression with field aliases?

[ddrillic]

Is there a way to simply the props.conf configurations and do the following in one command -

FIELDALIAS-alias01 = "apiRequest.reqHeader.appContext" AS appContext
FIELDALIAS-alias02 = "apiRequest.reqHeader.dob" AS dob
FIELDALIAS-alias03 = "apiRequest.reqHeader.encryptedUserName" AS encryptedUserName
FIELDALIAS-alias04 = "apiRequest.reqHeader.firstName" AS firstName
FIELDALIAS-alias05 = "apiRequest.reqHeader.lastName" AS lastName

[splunker12er]

wild cards are not supported in FIELDALIAS attribute. Try this REPORT method

props.conf

 [yourSourceType]
 REPORT-extractrequestheaders = extract_req_headers

transforms.conf

[extract_req_headers]
 REGEX = <use regex group match your field and values>
 FORMAT = $1::$2
 REPEAT_MATCH = true

thanks

[ddrillic]

Similar to How can we extract a json document within an event?

[p_gurav]

Can you try :

 FIELDALIAS-alias = apiRequest.reqHeader.* AS *