Can we assign two transforms.conf with Same sourcetypes in props.conf

[pankajupadhyay]

Hi,

Can we assign two different transforms.conf to same sourcetype ?

For example:

[sourcetype]

SEDCMD-test=

SEDCMD-test1=

transfrom-routing=transfromA,transfromB

Tranfroms.conf

[tranfromA]

Regex=Error

Format=target1

[tranfromA]

Regex=Something

Format=target1

So can i apply two different  SEDCMD syntax with same sourcetype config in props.conf ?

As two SEDCMD are doing different things ?

[richgalloway]

Yes, that is valid syntax.

[pankajupadhyay]

@richgalloway  In props.conf

two different SEDCMD will work I meant to say both does different objective in props.conf ?

[richgalloway]

Yes, it should work, although it's impossible to give a definitive answer without seeing concrete examples and sample data.