I have a strange problem.
In the search header, the value of the field created in props.conf is the same as the source path.
SH - props.conf
LOOKUP-center_tag_dest = ldcc_portal_asset IP AS dest OUTPUT group_id AS tag_dest
result
Normal values also appear but some of these problems are found
I want to know what is the cause and how to solve it.
result
source::udp:20001|host::61.111.55.40|ips_sniperips_evt
Strange data found in source type that doesn't match stanza
props.conf
stanza - [(?::){0}*_*_*_*]