REGEX to remove a word from indexing

[sergeyvinnik]

Anybody can answer to simple question?
How to remove from indexing host= d:\TEST.log just "<TD>" combination?
What should be in props.conf and what should be in transforms.conf ?
No one example from your answers is not working for me.

[martin_mueller]

Untested:

props.conf
[host::yourhost]
SEDCMD-removetd = s/<TD>//g

You may or may not need to escape the angle brackets with backslashes. Also, check if your host really is called d:\TEST.log because that looks awfully similar to a source value instead.

[martin_mueller]

Great. Don't forget to mark this as solved.

[sergeyvinnik]

It works!