Extracting Field from a Field other than _raw in props.conf

[Dark_Ichigo]

I want to add a Field Extractor Regex in props.conf but not from _raw but from another field

Example: rex Filed=test "(<BLA>\w+\w+)" I want to add this to props.conf but it thinks its extracting it from _raw and I want it to be extracted from test

How cant his be done?

[dshpritz · Accepted solution]

This can be done by using the SOURCE_KEY option in the transforms.conf. So, in props.conf

[mysourcetype]

REPORT-myextract = myextract

Then in transforms.conf:

[myextract]

SOURCE_KEY = test

REGEX = (\w+\w+)

Dave

[Dark_Ichigo]

Spot On! Thanks mate