Getting Data In
Highlighted

relationship between props.conf and transforms.conf

Contributor

I added a sourcetype, weblogic_access_log, with its customized field (wl_kv_and_fields
) in props.conf and transforms.conf. If I need to add another sourcetype e.g. tomcataccesslog with a different customized field e.g. tomcat_kv_and_fields. How could I define it in transforms.conf? Hope I am understood. Thanks!

in props.conf

[weblogic_access_log]

REPORT-myfields = wl_kv_and_fields

in transforms.conf

DELIMS = "\t"

FIELDS = date, time, ip, remote-user, user-agent, method, uri-stem, uri-query, status, bytes, time-taken
Tags (2)
0 Karma
Highlighted

Re: relationship between props.conf and transforms.conf

Path Finder

Hi shangshin

In your props.conf file you have "REPORT-myfields = wl_ kv_ and_ fields" so the stanza been referenced in transforms.conf has to be called "wl _kv _and _fields". For example

[wl_ kv_ and_fields]

DELIMS = "t"

FIELDS = date, time, ip, remote-user, user-agent, method, uri-stem, uri-query, status, bytes, time-taken

You can reference this stanza for any amount of sources/sourcetypes provided you use the line "REPORT-myfields = wl_ kv_ and_fields"

View solution in original post

0 Karma
Highlighted

Re: relationship between props.conf and transforms.conf

Contributor

good answer. Thanks!

0 Karma