I'm trying to add assets and users from an index that is not apart of the standard predefined sources. I can't seem to get any of the fields to validate. I've updated the props.conf from the exposure analytics app, adding in the stanza for the sourcetype from my data source. In there I've tried a few methods to ensure the field names that i see EA looking for (nt_host, user_id, etc) are parsed out. I verified on a basic SPL search, the field names are parsed and presented at search time. But I can't get any fields to validate.
Is there any documentation that speaks to bringing in your own data into exposure analytics?
