basically I took sourcetype ABC and am doing some regex and searching for 123, if I find that in the event I change the sourcetype to ABC:123. Now for this new sourcetype there is some wonky event breaking. Can I then create a new props entry [ABC:123] and perform all my line breaking and time extracting like I would for any normal event? As of right now it doesn't seem to be working. I have:
2021-01-26 00:00:44.2885 [INFO] [NT AUTHORITY\SYSTEM] SIXPACService.SplunkForwarder.SplunkWriter Attempting to Splunk Message from SITA:
<?xml version="1.0" encoding="utf-8"?>
and with the following props for testing:
LINE_BREAKER = SIXPACService.(.*)
and nothing happened when I tried that props. any ideas?