Getting Data In

SEDCMD to change field name

saifuddin9122
Path Finder

Hello
i have a log event as
DEBUG 2017.02.06 17:15:35.385: (common.work) Parsed source address, source='10.0.0.2' i want to change the source as src_ip at index time

can any one help me ?

Thanks in advance

0 Karma
1 Solution

somesoni2
Revered Legend

Try like this (props.conf on Indexer/heavy forwarder)

[YourSourceType]
...other settings..
SEDCMD-srcip = s/,\s+source=/, src_ip=/g

View solution in original post

0 Karma

twinspop
Influencer
SEDCMD-source = s/, source=/, src_ip=/

Although I think a better option is to use a field alias. Settings -> Fields -> Field aliases

somesoni2
Revered Legend

Try like this (props.conf on Indexer/heavy forwarder)

[YourSourceType]
...other settings..
SEDCMD-srcip = s/,\s+source=/, src_ip=/g

View solution in original post

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.