How can I move spath and mvexpand into props.conf?

[jnhth]

Hi,

This work when I use it at search time:

| spath path=messageParts{} output=message
| mvexpand message
| rex field=message "{\"disposition\":\s+\"(?<disposition>[^\"]+)\",\s+\"sha256\":\s+\"(?<sha>[^\"]+)\",\s+\"md5\":\s+\"(?<md5>[^\"]+)\",\s+\"filename\":\s+\"(?<filename>[^\"]+)\",\s+\"sandboxStatus\":\s+\"(?<sandboxStatus>[^\"]+)\",\s+\"oContentType\":\s+\"(?<oContentType>[^\"]+)\",\s+\"contentType\":\s+\"(?<contentType>[^\"]+)\"}"

BUT how to put this in props.conf?

I have tried MV_ADD = true - but no luck