Shoud it be done in the props.conf stanza at the moment of indexing?
I'm gonna have multiple .txt files indexed and later for a dashboard I need to get these filename to compare each other's values.
Is there a way to create a new field using eval for these filenames?
Thanks in advance!
- Vinicius Guerrero
It's a field like any other field you might have. You can include it in a table (
table source field1 field2... ), you can use it to group your results (
stats sum(field1) by source ), you can create another field by applying a regex to it (
rex field=source "regex-goes-here" ). Anything you can do with a text field you can do with