Hello everyone,
I see that this question has been posted many times, but none of the suggested fixes appear to work for me.
I have several data sources indexed with a wrong sourcetype.
E.g. my sourcetypes are log.1, log.2, log.3 ... and I'd like to rename them to "log" at search time.
I put in the props.conf on the search head the following:
[log*]
rename = log
but it doesn't seem to work after running the | extract reload=t.
I have also tried [log...] which should accomplish the same thing, or the somewhat arcane looking [(?:::){0}log*], but none of these appear to work.
Am I doing something obviously wrong here? I'm not touching transforms.conf, but per docs, I shouldn't really need to, and the simple two lines in props.conf on the search head should work.
Many thanks!
J.
