how to write the props.conf stanze to test the transforms Regex?

[pavanae]

The following is transforms.conf in my search head

[a_b]
SOURCE_KEY = _meta
REGEX = (logtype::A.*(id::(123|456)|(id::789.*username!::[a-zA-Z]{2,3}-+.*?-ZLX))
DEST_KEY = _ghi
FORMAT = KLMN

Now how to write my props.conf in order to test the REGEX in the above transforms.conf works. Especially I would like to see if the id=789 and username not equall to the string that ends with -ZLX?

[woodcock]

Why are you using SOURCE_KEY = _meta? What do you think that your REGEX will match (and have you tested it with a tool like http://www.RegEx101.com)?

[p_gurav · Accepted solution]

To props.conf, add the following lines:

[<sourcetype_name>]
TRANSFORMS-<class> = a_b

[pavanae]

Thanks @p_gurav. what does line 2 means. What should I specify there?

[woodcock]

The <class> is fully arbitrary and the only requirement is that it must be unique across all configuration settings so do not pick a common/simple string.