I have an issue with adding indexed fields to each of the new (splatted) sourcetype:
Configuration that "duplicated" indexed fields for each sourcetype:
Now I see fields: indexedfileds1, indexedfileds2 and indexedfileds3 as 200%,
For example: indexedfields1 values:
valuie1 150%
value2 50%
props.conf
[MAIN SOURCE]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
TIME_PREFIX = {\"time\":\"
MAX_TIMESTAMP_LOOKAHEAD = 25
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%6N%:z
TRUNCATE = 999999
TRANSFORMS-changesourcetype = sourcetype1, sourcetype2
TRANSFORMS-indexedfields = indexedfield1, indexedfield2, indexedfield3
[sourcetype1]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
TIME_PREFIX = {\"time\":\"
MAX_TIMESTAMP_LOOKAHEAD = 25
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%6N%:z
TRUNCATE = 999999
[sourcetype2]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
TIME_PREFIX = {\"time\":\"
MAX_TIMESTAMP_LOOKAHEAD = 25
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%6N%:z
TRUNCATE = 999999
transforms.conf
[indexedfield1]
REGEX=
FORMAT=
WRITE_META=
[indexedfield2]
REGEX=
FORMAT=
WRITE_META=
[indexedfield3]
REGEX=
FORMAT=
WRITE_META=
[sourcetype1]
DEST_KEY-MetaData:Sourcetype
REGEX = some regex
FORMAT = sourcetype::sourcetype1
[sourcetype2]
DEST_KEY-MetaData:Sourcetype
REGEX = some regex
FORMAT = sourcetype::sourcetype2
I thought to move the indexed fields to each of the new sourcetype but then I see no indexed fields.
Check with | tstats count
props.conf
[MAIN SOURCE]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
TIME_PREFIX = {\"time\":\"
MAX_TIMESTAMP_LOOKAHEAD = 25
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%6N%:z
TRUNCATE = 999999
TRANSFORMS-changesourcetype = sourcetype1, sourcetype2
[sourcetype1]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
TIME_PREFIX = {\"time\":\"
MAX_TIMESTAMP_LOOKAHEAD = 25
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%6N%:z
TRUNCATE = 999999
TRANSFORMS-indexedfields = indexedfield1, indexedfield2, indexedfield3
[sourcetype2]
SHOULD_LINEMERGE = false
LINE_BREAKER = ([\r\n]+)
TIME_PREFIX = {\"time\":\"
MAX_TIMESTAMP_LOOKAHEAD = 25
TIME_FORMAT = %Y-%m-%dT%H:%M:%S.%6N%:z
TRUNCATE = 999999
TRANSFORMS-indexedfields = indexedfield1, indexedfield2, indexedfield3
What is the needed configuration to see indexed fields per sourcetype, w/o showing 200%
Thanks
Nope,
No JSON. CEF events